CVE-2013-2147

Summary

CVE	CVE-2013-2147
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2013-06-07 14:03:19 UTC
Updated	2026-04-29 01:13:23 UTC
Description	The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.

Risk And Classification

Primary CVSS: v2.0 2.1 from [email protected]

AV:L/AC:L/Au:N/C:P/I:N/A:N

Problem Types: CWE-399 | n/a

CVSS v2.0 Breakdown

Access Vector

Local

Access Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

AV:L/AC:L/Au:N/C:P/I:N/A:N

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Linux	Linux Kernel	3.9	rc1	All	All
Operating System	Linux	Linux Kernel	3.9	rc2	All	All
Operating System	Linux	Linux Kernel	3.9	rc3	All	All
Operating System	Linux	Linux Kernel	3.9	rc4	All	All
Operating System	Linux	Linux Kernel	3.9	rc5	All	All
Operating System	Linux	Linux Kernel	3.9	rc6	All	All
Operating System	Linux	Linux Kernel	3.9	rc7	All	All
Operating System	Linux	Linux Kernel	3.9.0	All	All	All
Operating System	Linux	Linux Kernel	3.9.1	All	All	All
Operating System	Linux	Linux Kernel	3.9.2	All	All	All
Operating System	Linux	Linux Kernel	3.9.3	All	All	All
Operating System	Linux	Linux Kernel	All	All	All	All
Operating System	Suse	Linux Enterprise Server	10	sp4	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

References

Reference	Source	Link	Tags
[security-announce] SUSE-SU-2015:0812-1: important: Security update for	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org
USN-1997-1: Linux kernel (OMAP4) vulnerability \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
USN-2020-1: Linux kernel (Raring HWE) vulnerabilities \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
USN-2050-1: Linux kernel (OMAP4) vulnerabilities \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
Red Hat Customer Portal	af854a3a-2127-422b-91ae-364da2661108	rhn.redhat.com
USN-1999-1: Linux kernel (OMAP4) vulnerability \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
USN-2016-1: Linux kernel (EC2) vulnerabilities \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
oss-security - Re: CVE request: kernel: cpqarray/c: info leak in ida_locked_ioctl()	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com
LKML: Dan Carpenter: [patch] cpqarray: info leak in ida_locked_ioctl()	af854a3a-2127-422b-91ae-364da2661108	lkml.org
USN-1994-1: Linux kernel (Quantal HWE) vulnerability \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
USN-2017-1: Linux kernel vulnerabilities \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
USN-2023-1: Linux kernel vulnerabilities \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
LKML: Dan Carpenter: [patch] cciss: info leak in cciss_ioctl32_passthru()	af854a3a-2127-422b-91ae-364da2661108	lkml.org
USN-2015-1: Linux kernel vulnerabilities \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
Bug 971242 – CVE-2013-2147 Kernel: cpqarray/cciss: information leak via ioctl	af854a3a-2127-422b-91ae-364da2661108	bugzilla.redhat.com
USN-1996-1: Linux kernel vulnerability \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.