CVE-2013-7339 in Linux
Summary
by MITRE
The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/08/2026
The vulnerability identified as CVE-2013-7339 resides within the Linux kernel's implementation of the Reliable Datagram Sockets (RDS) protocol, specifically in the rds_ib_laddr_check function located in net/rds/ib.c. This flaw represents a critical security issue that affects Linux kernel versions prior to 3.12.8, where the absence of proper validation mechanisms in the RDS transport handling creates a pathway for malicious local users to exploit the system. The vulnerability manifests when a bind system call is executed against an RDS socket on a system that does not have any RDS transports available, creating a scenario where the kernel fails to properly handle the absence of transport layers.
The technical exploitation of this vulnerability occurs through a NULL pointer dereference condition that arises from the improper handling of RDS socket binding operations when no underlying transport mechanisms are present. When a local user attempts to bind an RDS socket on a system without RDS transports configured, the rds_ib_laddr_check function fails to validate the transport state before proceeding with operations that assume the existence of valid transport structures. This fundamental flaw in input validation and state management leads to the kernel attempting to dereference a NULL pointer, which results in an immediate system crash and denial of service condition. The vulnerability is classified under CWE-476 as a NULL pointer dereference, representing a classic software error where a pointer expected to contain a valid memory address instead points to NULL, causing the system to terminate unexpectedly.
The operational impact of this vulnerability extends beyond simple denial of service, as it represents a potential vector for more sophisticated attacks that could be leveraged by attackers with local access to the system. While the immediate effect is a system crash that prevents normal operations, the underlying issue suggests a broader problem with the kernel's error handling mechanisms and input validation processes. Attackers could potentially exploit this vulnerability to repeatedly crash the system, creating persistent denial of service conditions that could disrupt services or applications relying on the affected kernel version. The vulnerability also raises concerns about the stability of kernel subsystems and indicates potential issues with the overall quality assurance and testing procedures for kernel components that handle network protocols and socket operations.
The mitigation strategy for CVE-2013-7339 involves upgrading to Linux kernel version 3.12.8 or later, where the vulnerability has been addressed through proper input validation and error handling in the rds_ib_laddr_check function. System administrators should prioritize this update, particularly in environments where local users have access to systems running vulnerable kernel versions. Additionally, implementing proper access controls and limiting local user privileges can reduce the attack surface, though this does not eliminate the vulnerability itself. The fix typically involves adding proper checks to ensure that transport structures exist before attempting operations on them, preventing the NULL pointer dereference condition that leads to system crashes. Organizations should also consider monitoring for unusual system crashes or denial of service events that could indicate exploitation attempts, as these patterns may be indicative of this specific vulnerability being targeted.