Linux Kernel - Multiple Vulnerabilities
Summary
DSA-2745-1: linux - several. Affects linux versions < 3.2.46-1+deb7u1. Fixed in 3.2.46-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system. It provides essential functionality and interfaces for various hardware devices, file systems, and network protocols. The kernel is responsible for managing system resources and ensuring the security and stability of the operating system. However, several vulnerabilities have been discovered in the Linux kernel that may lead to denial of service, information leaks, or privilege escalation.
Vulnerability Detail
The Linux kernel is affected by multiple vulnerabilities:
-
CVE-2013-1059: A denial of service vulnerability in the Ceph distributed storage system allows remote attackers to cause a denial of service by sending a specially crafted auth_reply message.
-
CVE-2013-2148: An information leak in the fanotify subsystem allows local users to access sensitive kernel memory.
-
CVE-2013-2164: An information leak in the CD-ROM driver allows local users with a malfunctioning CD-ROM drive to access sensitive memory.
-
CVE-2013-2232: A denial of service vulnerability in the IPv6 subsystem allows local users to cause a denial of service by using an AF_INET6 socket to connect to an IPv4 destination.
-
CVE-2013-2234: A memory leak in the PF_KEYv2 sockets implementation allows local users to access sensitive kernel memory.
-
CVE-2013-2237: Another memory leak in the PF_KEYv2 sockets implementation allows local users to access sensitive kernel memory.
-
CVE-2013-2851: A privilege escalation vulnerability in the block subsystem allows local users with uid 0 to gain elevated ring 0 privileges on certain specially configured systems.
-
CVE-2013-2852: A privilege escalation vulnerability in the b43 network driver for certain Broadcom wireless devices allows local users with uid 0 to gain elevated ring 0 privileges on certain specially configured systems.
-
CVE-2013-4162: A denial of service vulnerability in the IPv6 networking subsystem allows local users to cause a system crash.
-
CVE-2013-4163: Another denial of service vulnerability in the IPv6 networking subsystem allows local users to cause a system crash.
How To Fix
Minimum fixed version
3.2.46-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple vulnerabilities have been discovered in the Linux kernel, including denial of service, information leaks, and privilege escalation. It is crucial to upgrade the linux and user-mode-linux packages to the fixed version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
These vulnerabilities can lead to denial of service, information leaks, and privilege escalation. Attackers may be able to crash the system, access sensitive kernel memory, or gain elevated privileges.
These vulnerabilities affect systems running the Linux kernel, specifically Debian 7.0 (wheezy) with the linux and user-mode-linux packages.
No specific workarounds are mentioned in the advisory. It is recommended to apply the provided fix by upgrading the affected packages.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by these vulnerabilities. Simply upload your package-lock.json file and the playground will analyze it for vulnerabilities.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-2745-1 (https://security-tracker.debian.org/tracker/DSA-2745-1).
Related vulnerabilities
Recent vulnerabilities recorded for linux.
