CVE-2013-1059: Null Pointer Dereference
Last updated 24 July 2024
Other sources
Linux kernel built with the Ceph core library(CONFIGCEPHLIB) support is vulnerable to a NULL pointer dereference flaw. It could occur while handling authreply messages from a CEPH client.
A remote user/program could use this flaw to crash the system, resulting in denial of service.
References:
http://hkpco.kr/advisory/CVE-2013-1059.txt
— Red Hat
net/ceph/authnone.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an authreply message that triggers an attempted buildrequest operation.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1059?
CVE-2013-1059 has a medium severity level as it can lead to a denial of service by crashing the system.
How do I fix CVE-2013-1059?
To fix CVE-2013-1059, you should upgrade to a patched version of the Linux kernel, specifically to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, or later.
Which Linux kernel versions are affected by CVE-2013-1059?
CVE-2013-1059 affects Linux kernel versions from 3.0.0 up to but not including 3.10.
Can CVE-2013-1059 be exploited remotely?
Yes, CVE-2013-1059 can be exploited remotely by a user or program through crafted auth_reply messages.
What type of vulnerability is CVE-2013-1059?
CVE-2013-1059 is a NULL pointer dereference vulnerability that can cause a system crash.