CVE-2013-2852: Medium severity Linux Linux kernel vulnerability
Format string vulnerability in the b43requestfirmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.
Other sources
The module parameter "fwpostfix" is userspace controllable, unfiltered, and is used to define the firmware filename. b43dorequestfw() populates ctx->errors[] on error, containing the firmware filename. b43err() parses its arguments as a format string. For systems with b43 hardware, this could lead to a uid-0 to ring-0 escalation.
Acknowledgements:
Red Hat would like to thank Kees Cook for reporting this issue.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2852?
CVE-2013-2852 is classified as a high severity vulnerability due to its potential to allow local users to gain elevated privileges.
How do I fix CVE-2013-2852?
To fix CVE-2013-2852, upgrade to a patched version of the Linux kernel, as specified in the affected software list.
Which Linux kernel versions are affected by CVE-2013-2852?
CVE-2013-2852 affects various Linux kernel versions from 2.6.12 up to 3.9.4.
Can CVE-2013-2852 be exploited remotely?
No, CVE-2013-2852 requires local access for exploitation, making it less of a concern for remote attacks.
What specific systems are impacted by CVE-2013-2852?
CVE-2013-2852 impacts systems using the Broadcom B43 wireless driver across various Linux distributions like Debian and Ubuntu.