CVE-2013-4300

2013-09-2510:31:29

CWE-264

redhat

web.nvd.nist.gov

linux kernel

cve-2013-4300

local privilege escalation

net/core/scm.c

pid spoofing

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

5.9

Confidence

High

EPSS

Percentile

9.8%

JSON

The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.11 performs a capability check in an incorrect namespace, which allows local users to gain privileges via PID spoofing.

Affected configurations

Nvd

Node

linuxlinux_kernelRange3.8.6–3.9

linuxlinux_kernelMatch3.9rc1

linuxlinux_kernelMatch3.9rc2

linuxlinux_kernelMatch3.9rc3

linuxlinux_kernelMatch3.9rc4

VendorProductVersionCPE
linuxlinux_kernel3.9cpe:/o:linux:linux_kernel:3.9:rc4::
linuxlinux_kernel3.9cpe:/o:linux:linux_kernel:3.9:rc3::
linuxlinux_kernel3.9cpe:/o:linux:linux_kernel:3.9:rc2::
linuxlinux_kernel3.9cpe:/o:linux:linux_kernel:3.9:rc1::

Vendor	Product	Version	CPE
linux	linux_kernel	3.9	cpe:/o:linux:linux_kernel:3.9:rc4::
linux	linux_kernel	3.9	cpe:/o:linux:linux_kernel:3.9:rc3::
linux	linux_kernel	3.9	cpe:/o:linux:linux_kernel:3.9:rc2::
linux	linux_kernel	3.9	cpe:/o:linux:linux_kernel:3.9:rc1::