CVE-2013-1772: Buffer Overflow
Description of the problem: A buffer overrun flaw was found in kernels from 3.0 to 3.4 when calling logprefix() function from callconsoledrivers(). In logprefix(), the access to "p[1]", "p[2]" or "simplestrtoul(&p[1], &endp, 10)" may cause a buffer overflow as this function is called from callconsoledrivers by passing "&LOGBUF(curindex)" where the index must be masked to do not exceed the buffer's boundary.
A local user able to write to /dev/kmsg could use this flaw to crash the system.
Note: /dev/kmsg is root writable only (at least on RHEL/Fedora), but it still might cause issues in restricted root environments.
References: https://bugs.gentoo.org/458780 https://secunia.com/advisories/52366/
Other sources
The logprefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a callconsoledrivers function call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1772?
CVE-2013-1772 has a medium severity level as it involves a buffer overrun that could potentially lead to arbitrary code execution.
How do I fix CVE-2013-1772?
To fix CVE-2013-1772, you should upgrade to a patched version of the Linux kernel, specifically 5.10.223-1 or above.
Which versions of the Linux kernel are affected by CVE-2013-1772?
CVE-2013-1772 affects Linux kernel versions between 3.0 and 3.4, including various release candidates.
What types of attacks can exploit CVE-2013-1772?
CVE-2013-1772 can be exploited through local privilege escalation attacks due to its buffer overflow nature.
Is CVE-2013-1772 under active attack?
There are no current indications that CVE-2013-1772 is actively exploited, but it is advisable to apply patches as a precaution.