SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2013-7263

The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or…

MEDIUM 4.9EPSS 0.46%

Does this matter?

Lower severity and a low EPSS score (0.46%). Track it; it rarely justifies an emergency change on its own.

Description

The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.

CVSS 2.0
4.9 MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:N
EPSS
0.46% probability · 39th percentile
CISA KEV
Not listed
Weakness
CWE-20
Affected
linux/linux kernel
Source
cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.