CVE-2013-4470

Kernel: net: memory corruption with UDP_CORK and UFO

Published Nov 4, 2013 CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2013-4338 The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.
Ubuntu USN Ubuntu USN USN-2040-1 Linux kernel (Quantal HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-2042-1 Linux kernel (Saucy HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-2043-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-2044-1 Linux kernel (OMAP4) vulnerabilities
Ubuntu USN Ubuntu USN USN-2046-1 Linux kernel (OMAP4) vulnerabilities
Ubuntu USN Ubuntu USN USN-2049-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-2050-1 Linux kernel (OMAP4) vulnerabilities
Ubuntu USN Ubuntu USN USN-2066-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-2067-1 Linux kernel (OMAP4) vulnerabilities
Ubuntu USN Ubuntu USN USN-2069-1 Linux kernel (Raring HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-2073-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-2233-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-2234-1 Linux kernel (EC2) vulnerabilities
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00064}

epss

{'score': 0.00122}

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 4:45 PM
Reserved
Jun 12, 2013, 12:00 AM
Status
Modified
Published
Nov 4, 2013, 3:55 PM
Modified
Jun 16, 2026, 11:57 PM
Severity
Important
Public date
Oct 21, 2013, 12:00 AM