CVE-2013-2547 Information disclosure in n/a
Local attackers with CAP_NET_ADMIN can read sensitive kernel heap memory due to uninitialized structure members in the crypto API.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2547?
CVE-2013-2547 is a low-severity vulnerability in Linux kernel, published on 14 Mar 2013. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.
Weakness: CWE-310
Which versions are affected by CVE-2013-2547?
It affects 2 products.
Products include Linux kernel, Redhat Enterprise Mrg.
How do I fix CVE-2013-2547?
Apply the vendor's patch.
Is CVE-2013-2547 being exploited?
There is no known exploitation of CVE-2013-2547 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2013-2547, GHSA-9558-m4h2-x96x.