CVE-2013-6282

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04Patch
http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282Patch
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2013/11/14/11Mailing List
http://www.securityfocus.com/bid/63734Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2067-1Third Party Advisory, VDB Entry
https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04Exploit, Patch
https://www.exploit-db.com/exploits/40975/Exploit, Third Party Advisory, VDB Entry
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04Patch
http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282Patch
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2013/11/14/11Mailing List
http://www.securityfocus.com/bid/63734Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2067-1Third Party Advisory, VDB Entry
https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04Exploit, Patch
https://www.exploit-db.com/exploits/40975/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282US Government Resource

Timeline

Published: Nov 20, 2013
Last modified: Jun 17, 2026
Added to CISA KEV: Sep 15, 2022
NVD status: Analyzed

Related CVEs from 2013

CVE-2013-62837.5VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code CVE-2013-62847.5Unspecified vulnerability in the Statutory Reporting for Insurance (FS_SR) component in the Financial Services module for SAP ERP Central Co CVE-2013-62855.0The search component in the Treasurer application in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to obtain sensitive query-st CVE-2013-628810.0Unspecified vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 has unknown impact and remote attack vectors,CVE-2013-62894.3Cross-site scripting (XSS) vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 allows remote attackers to inj CVE-2013-62959.8PrestaShop 1.5.5 vulnerable to privilege escalation via a Salesman account via upload module CVE-2013-62993.5Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Se CVE-2013-63003.5Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Se CVE-2013-63013.5Cross-site scripting (XSS) vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Se CVE-2013-63026.5SQL injection vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access CVE-2013-63034.0Directory traversal vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security CVE-2013-63044.0Multiple directory traversal vulnerabilities in Algo Risk Application (ARA) 2.4.0.1 through 4.9.1 in IBM Algo One allow remote authenticated