CVE-2013-3076

Published: Apr 22, 2013Modified: Apr 29, 2026

4.9

Vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Exploitability: 3.9 / Impact: 6.9

Source: NVD

Description

The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c.

Affected (7)

Products: Linux: Linux Kernel

1 product

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	version ≤ 3.9
Linux Linux Kernel	Version 3.9 rc1
Linux Linux Kernel	Version 3.9 rc2
Linux Linux Kernel	Version 3.9 rc3
Linux Linux Kernel	Version 3.9 rc4
Linux Linux Kernel	Version 3.9 rc5
Linux Linux Kernel	Version 3.9 rc6

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (14)

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103750.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104480.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00016.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2013/04/14/3

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1837-1

Source: cve@mitre.org

https://github.com/torvalds/linux/commit/72a763d805a48ac8c0bf48fdb510e84c12de51fe

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103750.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104480.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2013/04/14/3

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1837-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/torvalds/linux/commit/72a763d805a48ac8c0bf48fdb510e84c12de51fe

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.