CVE-2013-1979

2013-04-2600:00:00

ubuntu.com

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.001

Percentile

46.5%

JSON

The scm_set_cred function in include/net/scm.h in the Linux kernel before
3.8.11 uses incorrect uid and gid values during credentials passing, which
allows local users to gain privileges via a crafted application.

Bugs

<https://launchpad.net/bugs/1174827>

Notes

Author	Note
seth-arnold	41c21e351e79004dbb4efa4bc14a53a7e0af38c5 is additional hardening; it does not on its own fix this CVE, nor will it get its own CVE number, though it is useful enough to be included in an update. Andy recommended applying in conjunction with 83f1b4ba917db5dc5a061a44b3403ddb6e783494.

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchlinux< 3.2.0-44.69UNKNOWN
ubuntu12.10noarchlinux< 3.5.0-34.55UNKNOWN
ubuntu13.04noarchlinux< 3.8.0-19.30UNKNOWN
ubuntu12.04noarchlinux-armadaxp< 3.2.0-1619.29UNKNOWN
ubuntu12.10noarchlinux-armadaxp< 3.5.0-1616.24UNKNOWN
ubuntu12.04noarchlinux-lts-quantal< 3.5.0-34.55~precise1UNKNOWN
ubuntu12.04noarchlinux-ti-omap4< 3.2.0-1432.41UNKNOWN
ubuntu12.10noarchlinux-ti-omap4< 3.5.0-226.39UNKNOWN
ubuntu13.04noarchlinux-ti-omap4< 3.5.0-226.39UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	linux	< 3.2.0-44.69	UNKNOWN
ubuntu	12.10	noarch	linux	< 3.5.0-34.55	UNKNOWN
ubuntu	13.04	noarch	linux	< 3.8.0-19.30	UNKNOWN
ubuntu	12.04	noarch	linux-armadaxp	< 3.2.0-1619.29	UNKNOWN
ubuntu	12.10	noarch	linux-armadaxp	< 3.5.0-1616.24	UNKNOWN
ubuntu	12.04	noarch	linux-lts-quantal	< 3.5.0-34.55~precise1	UNKNOWN
ubuntu	12.04	noarch	linux-ti-omap4	< 3.2.0-1432.41	UNKNOWN
ubuntu	12.10	noarch	linux-ti-omap4	< 3.5.0-226.39	UNKNOWN
ubuntu	13.04	noarch	linux-ti-omap4	< 3.5.0-226.39	UNKNOWN