CVE-2013-2128

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34Broken Link
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=baff42ab1494528907bf4d5870359e31711746ae
http://rhn.redhat.com/errata/RHSA-2013-1051.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2013/05/29/11Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=968484Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/baff42ab1494528907bf4d5870359e31711746aePatch, Third Party Advisory
http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34Broken Link
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=baff42ab1494528907bf4d5870359e31711746ae
http://rhn.redhat.com/errata/RHSA-2013-1051.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2013/05/29/11Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=968484Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/baff42ab1494528907bf4d5870359e31711746aePatch, Third Party Advisory

Timeline

Published: Jun 7, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-21294.3Cross-site scripting (XSS) vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the CVE-2013-21304.0ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) e CVE-2013-21315.0Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial CVE-2013-21324.3bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause CVE-2013-21335.5The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) before 6.2.0, does not CVE-2013-21349.3Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not CVE-2013-21359.3Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both CVE-2013-21364.3Multiple cross-site scripting (XSS) vulnerabilities in Apache CloudStack before 4.1.1 allow remote attackers to inject arbitrary web script CVE-2013-21374.3Cross-site scripting (XSS) vulnerability in the "View Log" screen in the Webtools application in Apache Open For Business Project (aka OFBiz CVE-2013-21387.5The (1) uploadify and (2) flowplayer SWF files in Gallery 3 before 3.0.8 do not properly remove query parameters and fragments, which allows CVE-2013-21392.6Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors rela CVE-2013-21403.8The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5