CVE-2013-0313: Null Pointer Dereference
Last updated 24 July 2024
Other sources
Linux kernel built with Extended Verification Module(EVM) on and configured properly, is vulnerable to a NULL pointer de-reference issue, caused by accessing extended attribute routines of sockfs inode object.
An unprivileged user/program could use this flaw to crash the Linux kernel, resulting in DoS.
Upstream fix: -> https://git.kernel.org/linus/a67adb997419fb53540d4a4f79c6471c60bc69b6
— Red Hat
The evmupdateevmxattr function in security/integrity/evm/evmcrypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an attempted removexattr operation on an inode of a sockfs filesystem.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0313?
CVE-2013-0313 is considered a moderate severity vulnerability due to its potential to crash the Linux kernel.
How do I fix CVE-2013-0313?
To mitigate CVE-2013-0313, update your Linux kernel to version 5.10.223-1 or later.
Who is affected by CVE-2013-0313?
CVE-2013-0313 affects Linux kernel versions up to 3.7.4, including various release candidates.
What type of vulnerability is CVE-2013-0313?
CVE-2013-0313 is a NULL pointer dereference vulnerability in the extended attribute routines of sockfs inode.
Can unprivileged users exploit CVE-2013-0313?
Yes, unprivileged users could exploit CVE-2013-0313 to cause a system crash.