CVE-2013-6282
CVE-2013-6282
In short
A flaw in Linux kernel memory access functions on ARM devices allows attackers to read or change kernel memory directly through a malicious app. This is dangerous because kernel memory controls everything on the system, from user data to security features.
Technical detail
The get_user and put_user API functions in Linux kernel <3.5.5 on ARMv6k and ARMv7 platforms lack proper address validation, enabling arbitrary kernel memory read/write via user-space applications. This CWE-20 input validation failure allows privilege escalation and information disclosure on affected ARM-based systems, including Android devices.
Summary generated and translated by AI from the official description.
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 7
githubgithub.com/fi01/libput_user_exploit★ 27githubgithub.com/timwr/CVE-2013-6282★ 20githubgithub.com/jeboo/bypasslkm★ 13githubgithub.com/fi01/libget_user_exploit★ 8cve_referencewww.exploit-db.com/exploits/40975/unverifiedexploitdbwww.exploit-db.com/exploits/40975unverifiedexploitdbwww.exploit-db.com/exploits/31574unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282https://www.exploit-db.com/exploits/40975/http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5http://www.openwall.com/lists/oss-security/2013/11/14/11http://www.securityfocus.com/bid/63734http://www.ubuntu.com/usn/USN-2067-1