CVE-2013-2547

Description

The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.

Risk Information

Base Score

5.5

MODERATE

Vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.073

Associated Vulnerability

Vulnerability	OS Platform
Linux kernel (USN-1793-1) linux-image-3.2.0-40-generic_3.2.0-40.64_i386.deb	Linux
Linux kernel (USN-1793-1) linux-image-3.2.0-40-generic_3.2.0-40.64_amd64.deb	Linux
Linux kernel (USN-1793-1) linux-image-3.2.0-40-virtual_3.2.0-40.64_i386.deb	Linux
Linux kernel (USN-1793-1) linux-image-3.2.0-40-virtual_3.2.0-40.64_amd64.deb	Linux
Linux kernel (USN-1793-1) linux-image-3.2.0-40-generic-pae_3.2.0-40.64_i386.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234