CVE-2013-1792: Race Condition
A race condition leading to a NULL pointer dereference is discovered in the Linux kernel. It occurs during parallel invocation of installuserkeyrings & lookupuserkey routines.
An unprivileged user could use this flaw to crash the system, resulting in DoS.
Other sources
Race condition in the installuserkeyrings function in security/keys/processkeys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1792?
CVE-2013-1792 is classified as a high severity vulnerability due to the potential for denial of service caused by a NULL pointer dereference.
How do I fix CVE-2013-1792?
To mitigate CVE-2013-1792, upgrade your Linux kernel to version 5.10.223-1 or higher.
What systems are affected by CVE-2013-1792?
CVE-2013-1792 affects Linux kernel versions up to and including 3.8.2.
Can an unprivileged user exploit CVE-2013-1792?
Yes, an unprivileged user can exploit CVE-2013-1792 to crash the system by triggering the race condition.
What impact does CVE-2013-1792 have on the system?
The impact of CVE-2013-1792 is a denial of service (DoS), which results in the system becoming unresponsive.