CVE-2013-4737

NameCVE-2013-4737
DescriptionThe CONFIG_STRICT_MEMORY_RWX implementation for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly consider certain memory sections, which makes it easier for attackers to bypass intended access restrictions by leveraging the presence of RWX memory at a fixed location.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh (attack range: remote)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)jessie3.16.56-1+deb8u1fixed
jessie (security)3.16.57-2fixed
stretch4.9.110-1fixed
stretch (security)4.9.88-1+deb9u1fixed
buster4.16.16-2fixed
sid4.17.6-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsource(unstable)(not affected)
linux-2.6source(unstable)(not affected)

Notes

- linux <not-affected> (Affected code not in mainline kernel)
- linux-2.6 <not-affected> (Affected code not in mainline kernel)
https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=4256415b296348ff16cd17a5b8f8dce4dea37328

Search for package or bug name: Reporting problems