Integer overflow in Linux kernel - CVE-2013-4345

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU92808

Integer overflow in Linux kernel - CVE-2013-4345

Published: October 10, 2013 / Updated: February 13, 2023


Vulnerability identifier: #VU92808
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-4345
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple requests for small amounts of data, leading to improper management of the state of the consumed data.


Affected software

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-lts-quantal (Ubuntu package)
linux-lts-raring (Ubuntu package)
linux-lts-saucy (Ubuntu package)

How to mitigate CVE-2013-4345

Install update from vendor's repository.

linux (Ubuntu package) - addressed in versions 2.6.32-55.117, 3.2.0-59.90, 3.5.0-45.68, 3.11.0-15.23
linux-lts-quantal (Ubuntu package) - update to 3.5.0-45.68~precise1
linux-lts-raring (Ubuntu package) - update to 3.8.0-38.56~precise1
linux-lts-saucy (Ubuntu package) - update to 3.11.0-15.23~precise1

External References

Related Security Bulletins