CVE-2013-2237

Kernel: net: af_key: initialize satype in key_notify_policy_flush

Published Jul 4, 2013 CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Description
The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-2745-1 linux security update
Debian DSA Debian DSA DSA-2766-1 linux-2.6 security update
EUVD EUVD EUVD-2013-2188 The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.
Ubuntu USN Ubuntu USN USN-1912-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-1913-1 Linux kernel (EC2) vulnerabilities
Ubuntu USN Ubuntu USN USN-1970-1 Linux kernel (Quantal HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-1972-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-1973-1 Linux kernel (OMAP4) vulnerabilities
Ubuntu USN Ubuntu USN USN-1992-1 Linux kernel vulnerability
Ubuntu USN Ubuntu USN USN-1993-1 Linux kernel (OMAP4) vulnerability
Ubuntu USN Ubuntu USN USN-1995-1 Linux kernel (Raring HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-1998-1 Linux kernel vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 3:27 PM
Reserved
Feb 19, 2013, 12:00 AM
Status
Modified
Published
Jul 4, 2013, 9:55 PM
Modified
Jun 16, 2026, 11:52 PM
Severity
Low
Public date
Feb 18, 2013, 12:00 AM