CVE-2013-7266: Input Validation

Linux kernel built with the networking support(CONFIGNET) is vulnerable to an information leakage flaw in the socket layer. It could occur while doing recvmsg(2), recvfrom(2) socket calls. It occurs due to improperly initialised msgname & msgnamelen message header parameters.

A user/program could use this flaw to leak kernel memory bytes.

Upstream fix: ------------- -> https://git.kernel.org/linus/f3d3342602f8bcbf37d7c46641cb9bca7618eb1c

Original 'CVE-2013-6463' assigned to this issue has been rejected and the following 6 have been assigned for the same:

- CVE-2013-7266 (drivers/isdn/mISDN/socket.c), - CVE-2013-7267 (net/appletalk/ddp.c), - CVE-2013-7268 (net/ipx/afipx.c), - CVE-2013-7269 (net/netrom/afnetrom.c), - CVE-2013-7270 (net/packet/afpacket.c), - CVE-2013-7271 (net/x25/afx25.c)

== Name: CVE-2013-6463

REJECT

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-7266, CVE-2013-7267, CVE-2013-7268, CVE-2013-7269, CVE-2013-7270, CVE-2013-7271. Reason: This candidate is a duplicate of CVE-2013-7266, CVE-2013-7267, CVE-2013-7268, CVE-2013-7269, CVE-2013-7270, and CVE-2013-7271. Notes: All CVE users should reference CVE-2013-7266, CVE-2013-7267, CVE-2013-7268, CVE-2013-7269, CVE-2013-7270, and/or CVE-2013-7271 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. ===

— Red Hat

The mISDNsockrecvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.