CVE-2013-4470: Medium severity Linux Linux kernel vulnerability
Last updated 24 July 2024
Other sources
Linux kernel built with an Ethernet driver(ex virtio-net) which has UDP Fragmentation Offload(UFO) feature ON is vulnerable to a memory corruption flaw when UDPCORK socket option is set. It could occur when sending large messages, wherein not all messages are greater than maximum transfer unit(MTU) of the underlying medium.
An unprivileged user/program could use this flaw to crash the kernel resulting in DoS, or potentially escalate their privileges on the system.
Upstream fix: ------------- -> http://patchwork.ozlabs.org/patch/285292/ -> https://git.kernel.org/linus/c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b -> https://git.kernel.org/linus/e93b7d748be887cd7639b113ba7d7ef792a7efb9
— Red Hat
The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDPCORK option in a setsockopt system call and sends both short and long packets, related to the ipufoappenddata function in net/ipv4/ipoutput.c and the ip6ufoappenddata function in net/ipv6/ip6output.c.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 3.12
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4470?
CVE-2013-4470 is classified as a medium severity vulnerability due to its potential for memory corruption when large messages are sent.
How do I fix CVE-2013-4470?
To remediate CVE-2013-4470, update the Linux kernel to a patched version, specifically 5.10.223-1 or later.
What systems are affected by CVE-2013-4470?
CVE-2013-4470 affects Linux kernels up to version 3.11.7 and numerous releases from the 3.0.x series.
What exploitation outcome can occur from CVE-2013-4470?
Exploitation of CVE-2013-4470 may lead to system instability or crashes due to memory corruption.
Is CVE-2013-4470 easy to exploit?
CVE-2013-4470 exploits require specific conditions involving the use of the UDP_CORK socket option and large message sizes.