CVE-2013-3237 — Sensitive Information Exposure in Kernel

CWE-200 — Sensitive Information Exposure7 documents7 sources
Severity
4.9MEDIUMNVD
EPSS
0.1%
top 77.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Vmware Open-vm-toolsLinux Kernel
Timeline
PublishedApr 22
Latest updateMay 17

Description

The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.

CVSS vector

AV:L/AC:L/C:C/I:N/A:NExploitability: 3.9 | Impact: 6.9

Affected Packages2 packages

▶Debianvmware/open-vm-tools< 2:9.2.2-893683-8+3

🔴Vulnerability Details

3
GHSA
GHSA-p58m-x6g6-54jx: The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock↗2022-05-17
▶
OSV
CVE-2013-3237: The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock↗2013-04-22
▶
CVEList
CVE-2013-3237: The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock↗2013-04-22
▶

📋Vendor Advisories

2
Red Hat
kernel: VSOCK: Fix missing msg_namelen update in vsock_stream_recvmsg↗2013-04-07
▶
Debian
CVE-2013-3237: linux - The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kerne...↗2013
▶

💬Community

1
Bugzilla
CVE-2013-3237 kernel: VSOCK: Fix missing msg_namelen update in vsock_stream_recvmsg↗2013-04-24
▶
CVE-2013-3237 — Sensitive Information Exposure | cvebase