CVE-2013-2548
Published: 15 March 2013
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.
From the Ubuntu security team
Mathias Krause discovered information leaks in the Linux kernel's crypto algorithm report API. A local user could exploit these flaws to leak kernel stack and heap memory contents.
Priority
Medium
Status
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2548
- http://www.openwall.com/lists/oss-security/2013/03/07
- https://ubuntu.com/security/notices/USN-1793-1
- https://ubuntu.com/security/notices/USN-1794-1
- https://ubuntu.com/security/notices/USN-1795-1
- https://ubuntu.com/security/notices/USN-1796-1
- https://ubuntu.com/security/notices/USN-1797-1
- NVD
- Launchpad
- Debian