CVE-2013-2147: Low severity linux kernel vulnerability
Last updated 24 July 2024
Other sources
Linux kernel built with the Compaq SMART2(CONFIGBLKCPQDA) & Compaq Smart Array 5xxx(CONFIGBLKCPQCISSDA) support is vulnerable to an information leakage flaw. This could occur while doing ioctl(2) calls on block devices - /dev/ida/ & /dev/cciss/ - with command IDAGETPCIINFO' or CCISSPASSTHRU32'.
A user/program able to access above devices could use this flaw to leak kernel memory bytes.
Upstream fixes: --------------- -> https://lkml.org/lkml/2013/6/3/131 -> https://lkml.org/lkml/2013/6/3/127
— Red Hat
The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the idalockedioctl function in drivers/block/cpqarray.c or (2) a crafted CCISSPASSTHRU32 command for a /dev/cciss device, related to the ccissioctl32passthru function in drivers/block/cciss.c.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2147?
CVE-2013-2147 is considered to have a moderate severity due to its information leakage vulnerability.
How do I fix CVE-2013-2147?
To mitigate CVE-2013-2147, upgrade the Linux Kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, or newer.
Which systems are affected by CVE-2013-2147?
CVE-2013-2147 affects Linux Kernel versions up to and including 3.9.4 and specific configurations of SUSE Linux Enterprise Server.
What type of vulnerability is CVE-2013-2147?
CVE-2013-2147 is an information leakage flaw that can occur during ioctl(2) calls on specific block devices.
Is CVE-2013-2147 being actively exploited?
As of now, there are no known active exploits for CVE-2013-2147, but it is recommended to apply patches to avoid potential risks.