CVE-2013-2141: Low severity Linux Linux kernel vulnerability
Last updated 24 July 2024
Other sources
Linux kernel which supports tkill/tgkill routines is vulnerable to an information leakage flaw. It occurs when routine tkill(2) or tgkill(2) is used send signal to thread.
A user/program could use this flaw to leak kernel memory bytes.
Upstream fix: ------------- -> https://git.kernel.org/linus/b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2013/06/02/1
— Red Hat
The dotkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 3.8.9
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2141?
CVE-2013-2141 is classified as a medium severity vulnerability due to the potential for information leakage from the Linux kernel.
How do I fix CVE-2013-2141?
To fix CVE-2013-2141, update to a version of the Linux kernel later than 3.8.8 or apply the recommended patches provided by your distribution.
What are the affected versions of the Linux kernel for CVE-2013-2141?
The affected versions include Linux kernel 3.8.0 through 3.8.8, prior to the upstream fix.
What type of flaw is present in CVE-2013-2141?
CVE-2013-2141 presents an information leakage flaw that occurs when sending signals to threads using tkill or tgkill.
Who can be impacted by CVE-2013-2141?
Any user or program that utilizes the tkill or tgkill routines in the affected Linux kernel versions can be impacted by CVE-2013-2141.