CVE-2012-3400 Memory corruption in n/a
A heap-based buffer overflow in the Linux kernel UDF filesystem driver allows attackers to cause a system crash or potentially execute code via a crafted filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2012-3400?
CVE-2012-3400 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 3 Oct 2012. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.
Weakness: CWE-787
Which versions are affected by CVE-2012-3400?
It affects 2 products.
Linux distribution packages (18)
kernel Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-PAE Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-PAE-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-PAE-devel Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-debug Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-debug-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-debug-devel Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-debuginfo-common Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-devel Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-doc Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-headers Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-kdump Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-kdump-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-kdump-devel Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-xen Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-xen-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
kernel-xen-devel Red Hat:enterprise_linux:5::server | All versions | 0:2.6.18-348.2.1.el5 |
Products include Canonical Ubuntu Linux, Linux kernel.
How do I fix CVE-2012-3400?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2012-3400 being exploited?
There is no known exploitation of CVE-2012-3400 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2012-3400, GHSA-7p37-mp27-9qc9, RHSA-2013:0594.