NVD

Id
38326  
Name
CVE-2013-2239  
Description
vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the ploop_getdevice_ioc function in drivers/block/ploop/dev.c, or (2) a crafted quotactl system call, related to the compat_quotactl function in fs/quota/quota.c.  
Reject
 
CVSS Version
2  
CVSS Score
4.7  
Severity
Medium  
CVSS Base Score
4.7  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:N/A:N)  
Pub Date
2017-01-18  
Published
2013-11-12  
Modified Date
2014-02-06  
Seq
2013-2239  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
196019 38326 CVE-2013-2239 [oss-security] 20130704 OpenVZ security repport - Multiple memory leaks (CVE-2013-2239)  View
196020 38326 CVE-2013-2239 http://wiki.openvz.org/Download/kernel/rhel6-testing/042stab080.2  View
196021 38326 CVE-2013-2239 DSA-2766  View
196022 38326 CVE-2013-2239 https://bugs.gentoo.org/show_bug.cgi?id=475762  View
196023 38326 CVE-2013-2239 https://security-tracker.debian.org/tracker/CVE-2013-2239  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
23489 JVNDB-2013-005064 Linux Kernel 用 OpenVZ 修正におけるカーネルスタックメモリから重要な情報を取得される脆弱性 Linux Kernel 用 OpenVZ 修正の 042stab080.2 未満の vzkernel は、特定の長さの変数を初期化しないため、カーネルスタックメモリから重要な情報を取得される脆弱性が存在します。 CVE-2013-2239 62181 CVE-2013-2239 38326 4.7 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005064.html 2013-06-28 2013-11-13 View