CVE-2013-2547 REJECTED

The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.

EPSS 0.10% · 27.6th percentile

Risk Scores

EPSS Score
0.10%
27.6th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSlinux-aws0
Ubuntu:16.04:LTSlinux-snapdragon0
Ubuntu:14.04:LTSlinux-lts-utopic0
Ubuntu:14.04:LTSlinux0
Ubuntu:16.04:LTSlinux-hwe0
Ubuntu:16.04:LTSlinux-raspi20
Ubuntu:14.04:LTSlinux-manta0, 3.4.0-4.19
Ubuntu:16.04:LTSlinux0
Ubuntu:14.04:LTSlinux-lts-vivid0
Ubuntu:16.04:LTSlinux-goldfish3.4.0-4.26, 0, 3.4.0-4.24
Ubuntu:14.04:LTSlinux-lts-xenial0
Ubuntu:14.04:LTSlinux-lts-wily0
Ubuntu:16.04:LTSlinux-gke0
Ubuntu:14.04:LTSlinux-aws0

Timeline

References

Open in Interactive Console →