Input validation error in Linux kernel - CVE-2013-2206
Published: July 5, 2013 / Updated: August 11, 2020
Vulnerability identifier: #VU42749
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-2206
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted SCTP traffic.
Affected software
Linux kernel
SUSE Linux
SUSE Linux
How to mitigate CVE-2013-2206
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
External References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f2815633504b442ca0b0605c16bf3d88a3a0fcea
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00024.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://rhn.redhat.com/errata/RHSA-2013-1166.html
- http://rhn.redhat.com/errata/RHSA-2013-1173.html
- http://www.debian.org/security/2013/dsa-2766
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.5
- http://www.openwall.com/lists/oss-security/2013/06/21/1
- http://www.ubuntu.com/usn/USN-1939-1
- https://bugzilla.redhat.com/show_bug.cgi?id=976562
- https://github.com/torvalds/linux/commit/f2815633504b442ca0b0605c16bf3d88a3a0fcea