CVE-2013-2237

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.9

Description The issue concerns the key notify policy flush function in the Linux kernel, which fails to initialize a certain structure member. This allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify policy interface of an IPSec key socket.

Recommendations For Linux kernel versions prior to 3.9, update to version 3.9 or later to resolve the issue.