CVE-2013-1828

MediumCVSS 6.9/10Last modified Jun 16, 2026

Description

The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=726bc6b092da4c093eb74d13c07184b18c1af0f1Vendor Advisory
http://grsecurity.net/~spender/sctp.cExploit, Third Party Advisory
http://twitter.com/grsecurity/statuses/309805924749541376Third Party Advisory
http://www.exploit-db.com/exploits/24747Third Party Advisory, VDB Entry
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4Vendor Advisory
http://www.openwall.com/lists/oss-security/2013/03/08/2Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=919315Issue Tracking, Third Party Advisory
https://github.com/torvalds/linux/commit/726bc6b092da4c093eb74d13c07184b18c1af0f1Exploit, Patch, Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=726bc6b092da4c093eb74d13c07184b18c1af0f1Vendor Advisory
http://grsecurity.net/~spender/sctp.cExploit, Third Party Advisory
http://twitter.com/grsecurity/statuses/309805924749541376Third Party Advisory
http://www.exploit-db.com/exploits/24747Third Party Advisory, VDB Entry
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4Vendor Advisory
http://www.openwall.com/lists/oss-security/2013/03/08/2Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=919315Issue Tracking, Third Party Advisory
https://github.com/torvalds/linux/commit/726bc6b092da4c093eb74d13c07184b18c1af0f1Exploit, Patch, Third Party Advisory

Timeline

Published: Mar 22, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-18294.0calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscript CVE-2013-18305.0user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforpro CVE-2013-18315.0lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain CVE-2013-18324.0repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV p CVE-2013-18333.5Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before CVE-2013-18344.0notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows rem CVE-2013-18353.5Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obta CVE-2013-18366.5Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not properly manage privileges for WebDAV rep CVE-2013-18384.0OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote CVE-2013-18397.8The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a den CVE-2013-18406.5A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single CVE-2013-18414.3Net-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves to the source IP address, which might allow