CVE-2013-1929: Buffer Overflow
Heap-based buffer overflow in the tg3readvpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure.
Other sources
Linux kernel built with the Broadcom tg3 ethernet driver is vulnerable to a buffer overflow. This could occur when the tg3 driver reads and copies firmware string from hardware's product data(VPD), if it exceeds 32 characters.
A user with physical access to a machine could use this flaw to crash the system or, potentially, escalate their privileges on the system.
Upstream fix: ------------- -> https://git.kernel.org/linus/715230a44310a8cf66fbfb5a46f9a62a9b2de424
Reference: ---------- -> http://openwall.com/lists/oss-security/2013/04/05/2
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1929?
CVE-2013-1929 has a high severity rating due to its potential to cause a denial of service or allow arbitrary code execution.
How do I fix CVE-2013-1929?
To fix CVE-2013-1929, upgrade your Linux kernel to version 3.8.6 or later.
What systems are affected by CVE-2013-1929?
CVE-2013-1929 affects the Linux kernel versions prior to 3.8.6.
Can CVE-2013-1929 be exploited remotely?
CVE-2013-1929 requires physical proximity to exploit, limiting the potential attack vector.
What types of attacks can result from CVE-2013-1929?
Exploitation of CVE-2013-1929 can lead to system crashes or unauthorized code execution.