CVE-2013-3301: Null Pointer Dereference
Last updated 24 July 2024
Other sources
Linux kernel built with Function Tracers(CONFIGFUNCTIONTRACER) & Stack Tracers(CONFIGSTACKTRACER) support is vulnerable to a NULL pointer deference flaw. It occurs while writing to setftracepid' or setgraphfunction' files used by kernel tracers.
A privileged(CAPSYSADMIN) user could use this flaw to crash the system resulting in DoS.
Upstream fix: ------------- -> https://git.kernel.org/linus/6a76f8c0ab19f215af2a3442870eeb5f0e81998d
— Red Hat
The ftrace implementation in the Linux kernel before 3.8.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the CAPSYSADMIN capability for write access to the (1) setftracepid or (2) setgraphfunction file, and then making an lseek system call.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 3.8.8
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3301?
CVE-2013-3301 has a medium severity rating due to its potential to cause system instability and denial of service.
How do I fix CVE-2013-3301?
To fix CVE-2013-3301, upgrade to a patched version of the Linux kernel, such as 5.10.223-1 or higher.
Which versions of Linux kernel are affected by CVE-2013-3301?
CVE-2013-3301 affects Linux kernel versions from 3.1 to 3.8.7 and certain distributions such as Red Hat Enterprise Linux 6.0.
What is the nature of the vulnerability in CVE-2013-3301?
CVE-2013-3301 is a NULL pointer dereference flaw that occurs in function and stack tracer files of the Linux kernel.
Are there any known exploits for CVE-2013-3301?
As of now, there are no widely known exploits specifically targeting CVE-2013-3301, but the vulnerability could be leveraged by an attacker with sufficient privileges.