CVE-2013-2128: Medium severity linux kernel vulnerability
Last updated 24 July 2024
Other sources
Linux kernel which supports splice(2) call to move data across file/socket descriptors via a pipe buffers, is vulnerable to a kernel crash that occurs while calling splice(2) over a tcp socket which in turn calls tcpreadsock().
A user/program could use this flaw to cause system crash, resulting in DoS.
Upstream fix: ------------- -> https://git.kernel.org/linus/baff42ab1494528907bf4d5870359e31711746ae
— Red Hat
The tcpreadsock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2128?
CVE-2013-2128 has a medium severity level due to its potential to cause kernel crashes affecting system availability.
How do I fix CVE-2013-2128?
To fix CVE-2013-2128, update your Linux kernel to a version higher than 2.6.34, specifically to versions such as 5.10.223-1 or later.
Which systems are affected by CVE-2013-2128?
CVE-2013-2128 affects Linux kernel versions up to 2.6.34 across various Linux distributions.
What actions can be taken if my system is vulnerable to CVE-2013-2128?
If your system is vulnerable to CVE-2013-2128, you should immediately upgrade to a patched kernel version to mitigate the risk.
Is this vulnerability remotely exploitable in CVE-2013-2128?
CVE-2013-2128 may be exploitable remotely if an attacker can send specially crafted packets to a vulnerable TCP socket.