CVE-2012-2313: Low severity linux kernel vulnerability
Last updated 24 July 2024
Other sources
The dl2k driver's rioioctl call has a few issues: - No permissions checking - Implements SIOCGMIIREG and SIOCGMIIREG using the SIOCDEVPRIVATE numbers - Has a few ioctls that may have been used for debugging at one point but have no place in the kernel proper. This patch removes all but the MII ioctls, renumbers them to use the standard ones, and adds the proper permission check for SIOCSMIIREG. We can also get rid of the dl2k-specific struct miidata in favor of the generic struct miiioctldata. Since we have the phyid on hand, we can add the SIOCGMIIPHY ioctl too.
Most of the MII code for the driver could probably be converted to use the generic MII library but I don't have a device to test the results.
Upstream commit: http://git.kernel.org/linus/1bb57e940e1958e40d51f2078f50c3a96a9b2d75
Acknowledgements:
Red Hat would like to thank Stephan Mueller for reporting this issue.
— Red Hat
The rioioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2313?
CVE-2012-2313 is classified as a high-severity vulnerability due to its potential to allow unauthorized access and execution of inappropriate ioctls in the Linux kernel.
How do I fix CVE-2012-2313?
To fix CVE-2012-2313, it is recommended to upgrade to a patched version of the Linux kernel beyond 3.3.6.
Which versions of Linux kernel are affected by CVE-2012-2313?
CVE-2012-2313 affects Linux kernel versions 3.3 and earlier, including all release candidates and specific versions up to 3.3.6.
What are the implications of CVE-2012-2313 for my system?
The implications of CVE-2012-2313 include possible exploitation by attackers to gain elevated privileges and execute unauthorized commands within the kernel.
Is there a workaround for CVE-2012-2313 if I cannot upgrade?
While upgrading is the recommended method to mitigate CVE-2012-2313, restricting access to the affected ioctls can serve as a temporary workaround.