NVD

Id
38324  
Name
CVE-2013-2237  
Description
The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.  
Reject
 
CVSS Version
2  
CVSS Score
2.1  
Severity
Low  
CVSS Base Score
2.1  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2013-07-04  
Modified Date
2014-02-06  
Seq
2013-2237  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
195997 38324 CVE-2013-2237 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=85dfb745ee40232876663ae206cba35f24ab2a40  View
195998 38324 CVE-2013-2237 SUSE-SU-2013:1473  View
195999 38324 CVE-2013-2237 SUSE-SU-2013:1474  View
196000 38324 CVE-2013-2237 openSUSE-SU-2013:1971  View
196001 38324 CVE-2013-2237 RHSA-2013:1166  View
196002 38324 CVE-2013-2237 RHSA-2013:1173  View
196003 38324 CVE-2013-2237 DSA-2766  View
196004 38324 CVE-2013-2237 [oss-security] 20130703 Re: CVE Request: Earlier AF_KEY in key_notify_policy_flush  View
196005 38324 CVE-2013-2237 USN-1912-1  View
196006 38324 CVE-2013-2237 USN-1913-1  View
196007 38324 CVE-2013-2237 USN-1970-1  View
196008 38324 CVE-2013-2237 USN-1972-1  View
196009 38324 CVE-2013-2237 USN-1973-1  View
196010 38324 CVE-2013-2237 USN-1992-1  View
196011 38324 CVE-2013-2237 USN-1993-1  View
196012 38324 CVE-2013-2237 USN-1995-1  View
196013 38324 CVE-2013-2237 USN-1998-1  View
196014 38324 CVE-2013-2237 https://bugzilla.redhat.com/show_bug.cgi?id=981220  View
196015 38324 CVE-2013-2237 https://github.com/torvalds/linux/commit/85dfb745ee40232876663ae206cba35f24ab2a40  View
196016 38324 CVE-2013-2237 https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.9.bz2  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
21650 JVNDB-2013-003225 Linux Kernel の net/key/af_key.c 内の key_notify_policy_flush 関数における重要な情報を取得される脆弱性 Linux Kernel の net/key/af_key.c 内の key_notify_policy_flush 関数は、特定の構造体メンバを初期化しないため、カーネルヒープメモリから重要な情報を取得される脆弱性が存在します。 CVE-2013-2237 62179 CVE-2013-2237 38324 2.1 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-003225.html 2013-02-20 2014-02-27 View