CVE-2013-2141: Low severity linux kernel vulnerability
Last updated 24 July 2024
Other sources
Linux kernel which supports tkill/tgkill routines is vulnerable to an information leakage flaw. It occurs when routine tkill(2) or tgkill(2) is used send signal to thread.
A user/program could use this flaw to leak kernel memory bytes.
Upstream fix: ------------- -> https://git.kernel.org/linus/b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2013/06/02/1
— Red Hat
The dotkill function in kernel/signal.c in the Linux kernel before 3.8.9 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted application that makes a (1) tkill or (2) tgkill system call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2141?
CVE-2013-2141 is classified as a medium severity vulnerability due to the potential for information leakage from the Linux kernel.
How do I fix CVE-2013-2141?
To fix CVE-2013-2141, update to a version of the Linux kernel later than 3.8.8 or apply the recommended patches provided by your distribution.
What are the affected versions of the Linux kernel for CVE-2013-2141?
The affected versions include Linux kernel 3.8.0 through 3.8.8, prior to the upstream fix.
What type of flaw is present in CVE-2013-2141?
CVE-2013-2141 presents an information leakage flaw that occurs when sending signals to threads using tkill or tgkill.
Who can be impacted by CVE-2013-2141?
Any user or program that utilizes the tkill or tgkill routines in the affected Linux kernel versions can be impacted by CVE-2013-2141.