Actively exploited · Published Nov 19, 2013 · Assigned by mitre
CVE-2013-6282
High 8.8 Exploited
In plain English
A high-severity improper input validation in Kernel from Linux. Attackers are actively exploiting it in the wild (listed by CISA on September 15, 2022). The chance it is exploited in the next 30 days is estimated at 39.7% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Oct 6, 2022.
Official description
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 3.6.4-1~experimental.1 | DEBIAN-CVE-2013-6282 |
| Debian:13 | linux | 3.6.4-1~experimental.1 | DEBIAN-CVE-2013-6282 |
| Debian:14 | linux | 3.6.4-1~experimental.1 | DEBIAN-CVE-2013-6282 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5 x_refsource_CONFIRM
- 40975 exploit, x_refsource_EXPLOIT-DB
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04 x_refsource_CONFIRM
- http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282 x_refsource_CONFIRM
- 63734 vdb-entry, x_refsource_BID
- [oss-security] 20131114 CVE-2013-6282 - linux kernel: missing access checks in get_user/put_user on ARM mailing-list, x_refsource_MLIST
- https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04 x_refsource_CONFIRM
- USN-2067-1 vendor-advisory, x_refsource_UBUNTU
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282 government-resource