製品・ソフトウェアに関する情報

JVN脆弱性詳細

Linux Kernel の net/vmw_vsock/vmci_transport.c における重要な情報を取得される脆弱性

Title	Linux Kernel の net/vmw_vsock/vmci_transport.c における重要な情報を取得される脆弱性
Summary	Linux Kernel の net/vmw_vsock/vmci_transport.c 内の vmci_transport_dgram_dequeue 関数は、特定の長さの変数を適切に初期化しないため、カーネルスタックメモリから重要な情報を取得される脆弱性が存在します。
Possible impacts	ローカルユーザにより、巧妙に細工された recvmsg、または recvfrom システムコールを介して、カーネルスタックメモリから重要な情報を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	April 7, 2013, midnight
Registration Date	April 23, 2013, 4:32 p.m.
Last Update	April 23, 2013, 4:32 p.m.

Affected System

Linux

Linux Kernel 3.9-rc7 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-3236	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3236
National Vulnerability Database (NVD)
2	CVE-2013-3236	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3236

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
GitHub
1	VSOCK: vmci - fix possible info leak in vmci_transport_dgram_dequeue()	https://github.com/torvalds/linux/commit/680d04e0ba7e926233e3b9cee59125ce181f66ba
Linux Kernel
2	Linux Kernel Archives	http://www.kernel.org
3	linux/kernel/git/torvalds/linux.git	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=680d04e0ba7e926233e3b9cee59125ce181f66ba

その他

No	Name	URL
関連文書
1	[linux-kernel] 20130414 Linux 3.9-rc7	https://lkml.org/lkml/2013/4/14/107

Change Log

No	Changed Details	Date of change
0	[2013年04月23日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2013-3236

Summary	The vmci_transport_dgram_dequeue function in net/vmw_vsock/vmci_transport.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Publication Date	April 22, 2013, 8:41 p.m.
Registration Date	Jan. 26, 2021, 3:40 p.m.
Last Update	Nov. 21, 2024, 10:53 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=680d04e0ba7e926233e3b9cee59125ce181f66ba
2	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=680d04e0ba7e926233e3b9cee59125ce181f66ba
3	http://www.openwall.com/lists/oss-security/2013/04/14/3
4	http://www.openwall.com/lists/oss-security/2013/04/14/3
5	http://www.openwall.com/lists/oss-security/2013/04/22/11
6	http://www.openwall.com/lists/oss-security/2013/04/22/11
7	http://www.openwall.com/lists/oss-security/2013/04/22/13
8	http://www.openwall.com/lists/oss-security/2013/04/22/13
9	http://www.openwall.com/lists/oss-security/2013/04/22/14
10	http://www.openwall.com/lists/oss-security/2013/04/22/14
11	http://www.openwall.com/lists/oss-security/2013/04/22/3
12	http://www.openwall.com/lists/oss-security/2013/04/22/3
13	http://www.openwall.com/lists/oss-security/2013/04/23/2
14	http://www.openwall.com/lists/oss-security/2013/04/23/2
15	http://www.securityfocus.com/bid/59391
16	http://www.securityfocus.com/bid/59391
17	http://xforce.iss.net/xforce/xfdb/83698
18	http://xforce.iss.net/xforce/xfdb/83698
19	https://github.com/torvalds/linux/commit/680d04e0ba7e926233e3b9cee59125ce181f66ba	Vendor Advisory
20	https://github.com/torvalds/linux/commit/680d04e0ba7e926233e3b9cee59125ce181f66ba	Vendor Advisory
21	https://lkml.org/lkml/2013/4/14/107	Vendor Advisory
22	https://lkml.org/lkml/2013/4/14/107	Vendor Advisory

Common Vulnerabilities List