CVE-2013-4343: Use After Free
Last updated 24 July 2024
Other sources
Linux kernel built with the Universal TUN/TAP device driver(CONFIGTUN) support is vulnerable to a potential privilege escalation via an use-after-free flaw. It could occur while doing an ioctl(TUNSETIFF) call.
A privileged(CAPNETADMIN) user/program could use this flaw to crash the kernel resulting DoS or potentially escalate privileges to gain root access to a system.
Upstream fix: ------------- -> https://lkml.org/lkml/2013/9/11/335
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2013/09/12/3
— Red Hat
Use-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAPNETADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4343?
CVE-2013-4343 is considered a privilege escalation vulnerability due to a use-after-free flaw in the Linux kernel.
How do I fix CVE-2013-4343?
The vulnerability CVE-2013-4343 can be fixed by upgrading to patched versions of the Linux kernel, specifically versions 3.10.16 and 3.11.5 or later.
What systems are affected by CVE-2013-4343?
CVE-2013-4343 affects various Linux kernel versions between 3.8 and 3.10.16, as well as Ubuntu Linux versions 13.04 and 13.10.
Are there any known exploits for CVE-2013-4343?
While there are no specific public exploits for CVE-2013-4343 detailed, the vulnerability itself could be exploited by a privileged user.
What kind of user can exploit CVE-2013-4343?
Only users with CAP_NET_ADMIN privileges can potentially exploit CVE-2013-4343 due to its nature as a privilege escalation vulnerability.