CVE-2013-4270

Published: 8 November 2013

The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.

From the Ubuntu Security Team

Miroslav Vadkerti discovered a flaw in how the permissions for network sysctls are handled in the Linux kernel. An unprivileged local user could exploit this flaw to have privileged access to files in /proc/sys/net/.

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4270
• https://ubuntu.com/security/notices/USN-2049-1
• https://ubuntu.com/security/notices/USN-2020-1
• https://ubuntu.com/security/notices/USN-2023-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1252417