CVE-2013-7470
published 2019-04-23CVE-2013-7470: cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of…
PriorityP426medium5.9CVSS 3.0
AVNACHPRNUINSUCNINAH
EPSS
2.54%
83.4th percentile
cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.11.7-1 (bookworm) | linux 3.11.7-1 (bookworm) |
| linux | linux_kernel | < 3.11.7 | 3.11.7 |
| linux | linux_kernel | >= 0 < 3.11.7-1 | 3.11.7-1 |
| linux | linux_kernel | >= 0 < 3.11.7-1 | 3.11.7-1 |
| linux | linux_kernel | >= 0 < 3.11.7-1 | 3.11.7-1 |
| linux | linux_kernel | >= 0 < 3.11.7-1 | 3.11.7-1 |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.1HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
osv6.6MEDIUM
vendor_debian6.6MEDIUM
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: disabled CONFIG_NETLABEL in cipso_v4_validate in include/net/cipso_ipv4.h leads to denial of service
vendor_redhat·2013-10-19·CVSS 6.6
CVE-2013-7470 [MEDIUM] CWE-119 kernel: disabled CONFIG_NETLABEL in cipso_v4_validate in include/net/cipso_ipv4.h leads to denial of service
kernel: disabled CONFIG_NETLABEL in cipso_v4_validate in include/net/cipso_ipv4.h leads to denial of service
cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-alt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not
Debian
CVE-2013-7470: linux - cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7,...
vendor_debian·2013·CVSS 6.6
CVE-2013-7470 [MEDIUM] CVE-2013-7470: linux - cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7,...
cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.
Scope: local
bookworm: resolved (fixed in 3.11.7-1)
bullseye: resolved (fixed in 3.11.7-1)
forky: resolved (fixed in 3.11.7-1)
sid: resolved (fixed in 3.11.7-1)
trixie: resolved (fixed in 3.11.7-1)
GHSA
GHSA-fvc2-9q3j-5cg7: cipso_v4_validate in include/net/cipso_ipv4
ghsa_unreviewed·2022-05-05·CVSS 6.6
CVE-2013-7470 [MEDIUM] CWE-400 GHSA-fvc2-9q3j-5cg7: cipso_v4_validate in include/net/cipso_ipv4
cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.
OSV
CVE-2013-7470: cipso_v4_validate in include/net/cipso_ipv4
osv·2019-04-23·CVSS 6.6
CVE-2013-7470 [MEDIUM] CVE-2013-7470: cipso_v4_validate in include/net/cipso_ipv4
cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.
No detection rules found.
No public exploits indexed.
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f2e5ddcc0d12f9c4c7b254358ad245c9dddce13bhttps://github.com/torvalds/linux/commit/f2e5ddcc0d12f9c4c7b254358ad245c9dddce13bhttps://support.f5.com/csp/article/K21914362https://www.arista.com/en/support/advisories-notices/security-advisories/7098-security-advisory-40https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.7https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f2e5ddcc0d12f9c4c7b254358ad245c9dddce13bhttps://github.com/torvalds/linux/commit/f2e5ddcc0d12f9c4c7b254358ad245c9dddce13bhttps://support.f5.com/csp/article/K21914362https://www.arista.com/en/support/advisories-notices/security-advisories/7098-security-advisory-40
2019-04-23
Published