CVE-2013-2851: Medium severity Linux Linux kernel vulnerability
A flaw was found in the way certain disk names were interpreted by the Linux kernel.
Block layer uses the "diskname" field as a format string in a number of places. While this is normally not a problem due to how disk names are created (statically or incrementally), there is currently at least one way to define nearly arbitrary names via md.
A privileged (uid 0) local user could potentially use this flaw to execute code at ring0.
Acknowledgements:
Red Hat would like to thank Kees Cook for reporting this issue.
Other sources
Format string vulnerability in the registerdisk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/mdmod/parameters/newarray in order to create a crafted /dev/md device name.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2851?
CVE-2013-2851 has a medium severity rating due to its potential to cause local denial of service.
How do I fix CVE-2013-2851?
To fix CVE-2013-2851, upgrade to a Linux kernel version above 3.9.4 or apply appropriate security patches.
Which versions of the Linux kernel are affected by CVE-2013-2851?
CVE-2013-2851 affects Linux kernel versions up to 3.9.4, including various release candidates of version 3.9.
What kind of attack can be executed due to CVE-2013-2851?
CVE-2013-2851 could allow an attacker to exploit improper disk name handling resulting in a denial of service.
Who should be concerned about CVE-2013-2851?
System administrators using affected versions of the Linux kernel should prioritize patching against CVE-2013-2851.