Summaryinfo

A vulnerability was found in Linux Kernel up to 3.9-rc3. It has been declared as problematic. The impacted element is an unknown function of the file net/bridge/br_mdb.c of the component RTM_GETMDB Netlink Interface. The manipulation results in information disclosure. This vulnerability is known as CVE-2013-1873. No exploit is available. It is best practice to apply a patch to resolve this issue.

Detailsinfo

A vulnerability was found in Linux Kernel up to 3.9-rc3 (Operating System). It has been classified as problematic. Affected is some unknown processing of the file net/bridge/br_mdb.c of the component RTM_GETMDB Netlink Interface. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2634, CVE-2013-2635, CVE-2013-2636. Reason: This candidate is a duplicate of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636. Notes: All CVE users should reference one or more of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

The weakness was published 03/10/2013 by Mathias Krause as not defined mailinglist post (oss-sec). The advisory is available at seclists.org. The public release has been coordinated with the vendor. This vulnerability is traded as CVE-2013-1873 since 02/19/2013. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at OSVDB (91564†). Similar entries are available at VDB-8071 and VDB-8072. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 3.9-rc1
• 3.9-rc2
• 3.9-rc3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion