CVE-2013-4588: Buffer Overflow
Last updated 24 July 2024
Other sources
Linux kernel built with the IP Virtual Server(CONFIGIPVS) support is vulnerable to a buffer overflow flaw. It could occur while setting or retrieving socket options via setsockopt(2) or getsockopt(2) calls. Though a user needs to have CAPNETADMIN privileges to perform these IPVS operations.
A user/program with CAPNETADMIN privileges could use this flaw to further escalate their privileges on a system.
Upstream fix: ------------- -> https://git.kernel.org/linus/04bcef2a83f40c6db24222b27a52892cba39dffb
UPDATE: ======= The bounds check(below) added by the above patch are found to be redundant. The same are present in routine 'nfsockoptfind'. [1]
+ if (cmd < IPVSBASECTL || cmd > IPVSSOSETMAX) + return -EINVAL; + if (len < 0 || len > MAXARGLEN) + return -EINVAL;
[1] https://lkml.org/lkml/2009/9/30/265
That makes it a security non-issue.
Please see: -> http://seclists.org/oss-sec/2014/q1/174
— Red Hat
Multiple stack-based buffer overflows in net/netfilter/ipvs/ipvsctl.c in the Linux kernel before 2.6.33, when CONFIGIPVS is used, allow local users to gain privileges by leveraging the CAPNETADMIN capability for (1) a getsockopt system call, related to the doipvsgetctl function, or (2) a setsockopt system call, related to the doipvssetctl function.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 2.6.33Patch 04bcef2a83f40c6db24222b27a52892cba39dffb
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4588?
CVE-2013-4588 is considered a high-severity vulnerability due to the potential for buffer overflow leading to arbitrary code execution.
How do I fix CVE-2013-4588?
To fix CVE-2013-4588, update the Linux kernel to a version newer than 2.6.33 or apply the appropriate security patches provided by your distribution.
What systems are affected by CVE-2013-4588?
CVE-2013-4588 affects Linux kernels built with IP Virtual Server support, particularly versions up to 2.6.33 and specific Ubuntu and Debian distributions.
What are the potential impacts of CVE-2013-4588?
The potential impacts of CVE-2013-4588 include denial of service or arbitrary code execution with elevated privileges if exploited.
Who can exploit CVE-2013-4588?
An attacker with CAP_NET_ADMIN privileges can exploit CVE-2013-4588, making it necessary for them to have administrative capabilities on the affected system.