CVE-2013-4270
published 2013-12-09CVE-2013-4270: The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users…
PriorityP412low3.6CVSS 2.0
AVLACLAuNCPIPAN
EPSS
0.55%
43.1th percentile
The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.
Affected
238 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.11.5-1 (bookworm) | linux 3.11.5-1 (bookworm) |
| linux | linux_kernel | <= 3.11.4 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.03.6LOWAV:L/AC:L/Au:N/C:P/I:P/A:N
osv3.6LOW
vendor_debian3.6LOW
vendor_redhat3.6LOW
vendor_ubuntu3.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6f76-xg48-m996: The net_ctl_permissions function in net/sysctl_net
ghsa_unreviewed·2022-05-17
CVE-2013-4270 [LOW] CWE-20 GHSA-6f76-xg48-m996: The net_ctl_permissions function in net/sysctl_net
The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.
OSV
CVE-2013-4270: The net_ctl_permissions function in net/sysctl_net
osv·2013-12-09·CVSS 3.6
CVE-2013-4270 [LOW] CVE-2013-4270: The net_ctl_permissions function in net/sysctl_net
The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2013-12-07·CVSS 3.6
CVE-2013-4270 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Miroslav Vadkerti discovered a flaw in how the permissions for network
sysctls are handled in the Linux kernel. An unprivileged local user could
exploit this flaw to have privileged access to files in /proc/sys/net/.
(CVE-2013-4270)
A flaw was discovered in the Linux kernel's dm snapshot facility. A remote
authenticated user could exploit this flaw to obtain sensitive information
or modify/corrupt data. (CVE-2013-4299)
Wannes Rombouts reported a vulnerability in the networking tuntap interface
of the Linux kernel. A local user with the CAP_NET_ADMIN capability could
leverage this flaw to gain full admin privileges. (CVE-2013-4343)
Alan Chester reported a flaw in the IPv6 Stream Control Trans
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2013-11-08·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
Dan Carpenter discovered an information leak in the HP Smart Array and
Compaq SMART2 disk-array driver in the Linux kernel. A local user could
exploit this flaw to obtain sensitive information from kernel memory.
(CVE-2013-2147)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem
when CONFIG_HID_ZEROPLUS is enabled. A physically proximate attacker could
le
Ubuntu
Linux kernel (Raring HWE) vulnerabilities
vendor_ubuntu·2013-11-08·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel (Raring HWE) vulnerabilities
Title: Linux kernel (Raring HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
Dan Carpenter discovered an information leak in the HP Smart Array and
Compaq SMART2 disk-array driver in the Linux kernel. A local user could
exploit this flaw to obtain sensitive information from kernel memory.
(CVE-2013-2147)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem
when CONFIG_HID_ZEROPLUS is enabled. A physically proximate atta
Red Hat
kernel: net: permissions flaw in /proc/sys/net
vendor_redhat·2013-10-06·CVSS 3.6
CVE-2013-4270 [LOW] kernel: net: permissions flaw in /proc/sys/net
kernel: net: permissions flaw in /proc/sys/net
The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.
Statement: This issue does not affect the version of the kernel package as shipped with Red Hat Enterprise Linux 5 and 6.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Debian
CVE-2013-4270: linux - The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before ...
vendor_debian·2013·CVSS 3.6
CVE-2013-4270 [LOW] CVE-2013-4270: linux - The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before ...
The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.
Scope: local
bookworm: resolved (fixed in 3.11.5-1)
bullseye: resolved (fixed in 3.11.5-1)
forky: resolved (fixed in 3.11.5-1)
sid: resolved (fixed in 3.11.5-1)
trixie: resolved (fixed in 3.11.5-1)
No detection rules found.
No public exploits indexed.
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2433c8f094a008895e66f25bd1773cdb01c91d01http://rhn.redhat.com/errata/RHSA-2014-0100.htmlhttp://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.5http://www.ubuntu.com/usn/USN-2049-1https://bugzilla.redhat.com/show_bug.cgi?id=1027752https://github.com/torvalds/linux/commit/2433c8f094a008895e66f25bd1773cdb01c91d01http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2433c8f094a008895e66f25bd1773cdb01c91d01http://rhn.redhat.com/errata/RHSA-2014-0100.htmlhttp://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.5http://www.ubuntu.com/usn/USN-2049-1https://bugzilla.redhat.com/show_bug.cgi?id=1027752https://github.com/torvalds/linux/commit/2433c8f094a008895e66f25bd1773cdb01c91d01
2013-12-09
Published