PT-2013-1022
CVE-2013-2147
·
تاريخ النشر
2013-06-07
·
تاريخ التحديث
2018-01-09
الوصف من
CVSS 2.0
2.1
منخفضةالمقاييسAV:L/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 3.9.4
Description
The issue allows local users to obtain sensitive information from kernel memory. This is achieved through either a crafted IDAGETPCIINFO command for a /dev/ida device, related to the
ida locked ioctl function in drivers/block/cpqarray.c, or a crafted CCISS PASSTHRU32 command for a /dev/cciss device, related to the cciss ioctl32 passthru function in drivers/block/cciss.c.Recommendations
For Linux kernel versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue.
As a temporary workaround, consider restricting access to the /dev/ida and /dev/cciss devices to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾