NVD

Id
38322  
Name
CVE-2013-2234  
Description
The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.  
Reject
 
CVSS Version
2  
CVSS Score
2.1  
Severity
Low  
CVSS Base Score
2.1  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2013-07-04  
Modified Date
2014-01-30  
Seq
2013-2234  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
195969 38322 CVE-2013-2234 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a5cc68f3d63306d0d288f31edfc2ae6ef8ecd887  View
195970 38322 CVE-2013-2234 SUSE-SU-2013:1473  View
195971 38322 CVE-2013-2234 SUSE-SU-2013:1474  View
195972 38322 CVE-2013-2234 openSUSE-SU-2013:1971  View
195973 38322 CVE-2013-2234 RHSA-2013:1166  View
195974 38322 CVE-2013-2234 RHSA-2013:1645  View
195975 38322 CVE-2013-2234 DSA-2766  View
195976 38322 CVE-2013-2234 [oss-security] 20130702 Re: CVE Request: information leak in AF_KEY notify messages  View
195977 38322 CVE-2013-2234 USN-1912-1  View
195978 38322 CVE-2013-2234 USN-1913-1  View
195979 38322 CVE-2013-2234 USN-1938-1  View
195980 38322 CVE-2013-2234 USN-1941-1  View
195981 38322 CVE-2013-2234 USN-1942-1  View
195982 38322 CVE-2013-2234 USN-1943-1  View
195983 38322 CVE-2013-2234 USN-1944-1  View
195984 38322 CVE-2013-2234 USN-1945-1  View
195985 38322 CVE-2013-2234 USN-1946-1  View
195986 38322 CVE-2013-2234 USN-1947-1  View
195987 38322 CVE-2013-2234 https://bugzilla.redhat.com/show_bug.cgi?id=980995  View
195988 38322 CVE-2013-2234 https://github.com/torvalds/linux/commit/a5cc68f3d63306d0d288f31edfc2ae6ef8ecd887  View
195989 38322 CVE-2013-2234 https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.10.bz2  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
21649 JVNDB-2013-003224 Linux Kernel の net/key/af_key.c におけるカーネルヒープメモリから重要な情報を取得される脆弱性 Linux Kernel の net/key/af_key.c 内の (1) key_notify_sa_flush、および (2) key_notify_policy_flush 関数は、特定の構造体メンバを初期化しないため、カーネルヒープメモリから重要な情報を取得される脆弱性が存在します。 CVE-2013-2234 62176 CVE-2013-2234 38322 2.1 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003224.html 2013-06-26 2014-02-20 View