CVE-2013-1979
Published: 26 April 2013
The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application.
From the Ubuntu security team
Andy Lutomirski discover an error in the Linux kernel's credential handling on unix sockets. A local user could exploit this flaw to gain administrative privileges.
Priority
High
Status
Notes
| Author | Note |
|---|---|
| seth-arnold | 41c21e351e79004dbb4efa4bc14a53a7e0af38c5 is additional hardening; it does not on its own fix this CVE, nor will it get its own CVE number, though it is useful enough to be included in an update. Andy recommended applying in conjunction with 83f1b4ba917db5dc5a061a44b3403ddb6e783494. |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1979
- https://ubuntu.com/security/notices/USN-1815-1
- https://ubuntu.com/security/notices/USN-1833-1
- https://ubuntu.com/security/notices/USN-1839-1
- https://ubuntu.com/security/notices/USN-1883-1
- https://ubuntu.com/security/notices/USN-1880-1
- https://ubuntu.com/security/notices/USN-1882-1
- https://ubuntu.com/security/notices/USN-1881-1
- NVD
- Launchpad
- Debian