CVE-2013-0310: Null Pointer Dereference
Last updated 24 July 2024
Other sources
The cipsov4validate function in net/ipv4/cipsoipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPTCIPSO IPOPTIONS setsockopt system call.
— Launchpad
The skb argument to cipsov4validate() is NULL when called via the setsockopt() syscall. An local user able to set CIPSO IP options on the socket could use this flaw to crash the system.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=89d7ae34cdda4195809a5a987f697a517a2a3177
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0310?
CVE-2013-0310 has been identified as a serious vulnerability that can lead to denial of service through null pointer dereference.
How do I fix CVE-2013-0310?
To remediate CVE-2013-0310, upgrade to a version of the Linux kernel later than 3.4.8 or apply relevant patches.
Which Linux kernel versions are affected by CVE-2013-0310?
CVE-2013-0310 affects the Linux kernel versions prior to 3.4.8 and specific release candidates such as 3.0-rc1 to 3.0-rc7.
What impact can CVE-2013-0310 cause?
The impact of CVE-2013-0310 includes potential denial of service that may crash the system.
Is CVE-2013-0310 exploitable remotely?
CVE-2013-0310 is primarily a local vulnerability, requiring local user access for exploitation.