Linux Kernel CVE-2013-6282 Local Privilege Escalation Vulnerabilities

Bugtraq ID:	63734
Class:	Unknown
CVE:	CVE-2013-6282
Remote:	No
Local:	Yes
Published:	Nov 14 2013 12:00AM
Updated:	Jan 12 2017 01:07AM
Credit:	Catalin Marinas
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Linux kernel 3.11.3 Linux kernel 3.10.14 Linux kernel 3.10.10 Linux kernel 3.10.9 Linux kernel 3.10.7 Linux kernel 3.2.23 Linux kernel 3.2.13 Linux kernel 3.2.12 Linux kernel 3.2.1 Linux kernel 3.2.42 Linux kernel 3.2.38 Linux kernel 3.2.2 Linux kernel 3.2 Linux kernel 3.12 Linux kernel 3.11.6 Linux kernel 3.11-rc7 Linux kernel 3.11-rc4 Linux kernel 3.11-rc1 Linux kernel 3.11 Linux kernel 3.10.5 Linux kernel 3.10.17 Linux kernel 3.10-rc5 Linux kernel 3.10 codeaurora QRD Android msm-3.4 codeaurora QRD Android jb* codeaurora QRD Android ics* codeaurora Firefox OS for MSM msm-3.4 codeaurora Firefox OS for MSM jb* codeaurora Firefox OS for MSM ics* codeaurora Android for MSM msm-3.4 codeaurora Android for MSM jb* codeaurora Android for MSM ics*
Not Vulnerable:

Linux Kernel CVE-2013-6282 Local Privilege Escalation Vulnerabilities

The Linux kernel is prone to multiple local privilege-escalation vulnerabilities.

Local attackers may exploit these issues to read and write kernel memory and gain elevated privileges.

Linux Kernel CVE-2013-6282 Local Privilege Escalation Vulnerabilities

The following exploit code is available:

• /data/vulnerabilities/exploits/63734.rb

Linux Kernel CVE-2013-6282 Local Privilege Escalation Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Linux Kernel CVE-2013-6282 Local Privilege Escalation Vulnerabilities

References:

• ARM: 7527/1: uaccess: explicitly check __user pointer when !CPU_USE_DOMAINS (kernel.org)
  
• Linux Homepage (Linux)
  
• Linux kernel Homepage (kernel.org)
  
• Missing access checks in put_user/get_user kernel API (CVE-2013-6282) (Code Aurora Forum)