CVE-2013-1928: Infoleak
Last updated 24 July 2024
Other sources
Linux kernel built with Digital Video Broadcasting(CONFIGDVB) support are vulnerable to an information leak issue. The leak could occurs via an ioctl(VIDEOSETSPUPALETTE) call on a device file under - /dev/dvb/ - tree.
Upstream fix: ------------- -> https://git.kernel.org/linus/12176503366885edd542389eed3aaf94be163fdb
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2013/04/05/3
— Red Hat
The dovideosetspupalette function in fs/compatioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEOSETSPUPALETTE ioctl call on a /dev/dvb device.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 3.6.5
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1928?
CVE-2013-1928 is classified as a medium severity vulnerability due to its ability to cause an information leak.
How do I fix CVE-2013-1928?
To fix CVE-2013-1928, users should upgrade to a patched version of the Linux kernel, specifically version 3.6.4 or later.
Which versions of the Linux kernel are affected by CVE-2013-1928?
CVE-2013-1928 affects Linux kernel versions up to and including 3.6.4 and certain 3.0 release candidates.
What issue does CVE-2013-1928 exploit?
CVE-2013-1928 exploits an information leak issue through an ioctl call on a device file under the /dev/dvb/ directory.
Is there a workaround for CVE-2013-1928?
There are no documented workarounds for CVE-2013-1928 other than applying the necessary updates to the Linux kernel.