CVE-2013-0290: Input Validation
A flaw was found in the way skbrecvdatagram() processed skbs with no payload when MSGPEEK was requested. An unprivileged local user could use this flaw to cause local denial of service.
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=77c1090
References: http://seclists.org/oss-sec/2013/q1/310
Other sources
The skbrecvdatagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSGPEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0290?
CVE-2013-0290 has a severity rating that can potentially allow an unprivileged local user to cause a denial of service.
How do I fix CVE-2013-0290?
To fix CVE-2013-0290, update to Linux kernel versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
Which Linux kernel versions are affected by CVE-2013-0290?
CVE-2013-0290 affects Linux kernel versions up to and including 3.7.9.
Is CVE-2013-0290 a remote or local vulnerability?
CVE-2013-0290 is a local vulnerability that requires an unprivileged local user to exploit.
What impact does CVE-2013-0290 have on system security?
CVE-2013-0290 can lead to local denial of service, impacting system availability.