CVE-2013-6282

NameCVE-2013-6282
DescriptionThe (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)jessie3.16.56-1+deb8u1fixed
jessie (security)3.16.81-1fixed
stretch4.9.189-3fixed
stretch (security)4.9.189-3+deb9u2fixed
buster4.19.67-2+deb10u1fixed
buster (security)4.19.67-2+deb10u2fixed
bullseye, sid5.4.8-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsource(unstable)3.6.4-1~experimental.1
linuxsourcewheezy3.2.53-1
linux-2.6source(unstable)(not affected)

Notes

- linux-2.6 <not-affected> (Introduced in 2.6.38)
https://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/arch/arm/include/asm/uaccess.h?id=8404663f81d212918ff85f493649a7991209fa04

Search for package or bug name: Reporting problems