CVE-2013-0914: Low severity linux kernel vulnerability
Last updated 24 July 2024
Other sources
Linux kernel is vulnerable to an information leakage flaw. This occurs when a process calls routine - sigaction() - to access - sarestorer - parameter. This parameter points to an address that belongs to its parent process' address space.
A user could use this flaw to infer address layout of a process.
Reference: ---------- -> https://lkml.org/lkml/2013/3/11/498 -> http://www.openwall.com/lists/oss-security/2013/03/11/8
— Red Hat
The flushsignalhandlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sarestorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0914?
CVE-2013-0914 has a medium severity rating due to its potential for information leakage.
How do I fix CVE-2013-0914?
To fix CVE-2013-0914, update your Linux kernel to version 5.10.223-1 or higher, or to any version above 6.1.119-1.
Which versions of the Linux kernel are affected by CVE-2013-0914?
CVE-2013-0914 affects Linux kernel versions up to 3.8.3, including 3.8.0, 3.8.1, and 3.8.2.
Is CVE-2013-0914 an issue for all Linux distributions?
CVE-2013-0914 primarily affects those Linux distributions utilizing the vulnerable kernel versions.
What is the nature of the vulnerability in CVE-2013-0914?
CVE-2013-0914 is an information leakage flaw that allows a process to access memory belonging to its parent process.