CVE-2013-2239: Medium severity OpenVZ vzkernel vulnerability

Published Nov 12, 2013

Updated

vzkernel before 042stab080.2 in the OpenVZ modification for the Linux kernel 2.6.32 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via (1) a crafted ploop driver ioctl call, related to the ploopgetdeviceioc function in drivers/block/ploop/dev.c, or (2) a crafted quotactl system call, related to the compatquotactl function in fs/quota/quota.c.

Affected Software

2 affected componentsFixes available

OpenVZ vzkernel=2.6.32

debian/linux

6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1

Event History

Nov 12, 2013

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-2766

Frequently Asked Questions

What is the severity of CVE-2013-2239?

The severity of CVE-2013-2239 is classified as medium with a score of 4.7.

How do I fix CVE-2013-2239?

To fix CVE-2013-2239, upgrade to vzkernel version 042stab080.2 or later.

What is the impact of CVE-2013-2239?

CVE-2013-2239 allows local users to obtain sensitive information from kernel stack memory.

Which software is affected by CVE-2013-2239?

CVE-2013-2239 affects the OpenVZ vzkernel and Debian/Linux systems.

Why is CVE-2013-2239 considered a risk?

CVE-2013-2239 is considered a risk because it can expose sensitive information to unauthorized local users.