A vulnerability was found in Linux Kernel (Operating System) (the affected version is unknown). It has been classified as problematic. This affects an unknown code of the file net/socket.c. The manipulation with an unknown input leads to a memory leak vulnerability. CWE is classifying the issue as CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. This is going to have an impact on confidentiality, and integrity.

The weakness was disclosed 11/21/2013 by Hannes Frederic Sowa as Re: CVE Request: Linux kernel: net: uninitialised memory leakage as confirmed mailinglist post (oss-sec). The advisory is shared at seclists.org. The public release has been coordinated in cooperation with Linux. An attack has to be approached locally. Technical details and a public exploit are known.

After immediately, there has been an exploit disclosed. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.

Applying the patch net: add BUG_ON if kernel advertises msg_namelen > sizeof(struct sockaddr_storage) is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The entries 11336 and 11335 are pretty similar.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion