CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
Description
CVE-2013-6282 is an improper input validation vulnerability in the Linux kernel's get_user and put_user API functions on ARM v6k/v7 platforms. The functions fail to validate the target address, allowing applications to read and write kernel memory, which leads to privilege escalation. With an EPSS score of 67.65% (98.55th percentile), this long-standing kernel vulnerability remains highly likely to be exploited. CISA added CVE-2013-6282 to the KEV catalog on September 15, 2022, nearly a decade after its disclosure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | < 3.2.54; >= 3.3, < 3.4.12; >= 3.5, < 3.5.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04(Patch)
- http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282(Patch)
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5(Mailing List, Vendor Advisory)
- http://www.openwall.com/lists/oss-security/2013/11/14/11(Mailing List)
- http://www.securityfocus.com/bid/63734(Third Party Advisory, VDB Entry)
- http://www.ubuntu.com/usn/USN-2067-1(Third Party Advisory, VDB Entry)
- https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04(Exploit, Patch)
- https://www.exploit-db.com/exploits/40975/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
CVE-2013-6282 is an improper input validation vulnerability in the Linux kernel's ARM architecture-specific code. The get_user and put_user functions fail to validate target memory addresses on ARM v6k/v7 platforms, allowing userspace applications to bypass kernel memory protection boundaries.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2013-6282 allows local privilege escalation on Linux systems running on ARM v6k/v7 processors, which includes a vast number of Android devices and embedded systems. The vulnerability enables any local application to read from and write to arbitrary kernel memory, providing a direct path to root privilege escalation. Confidentiality is critically impacted as all kernel memory becomes readable, including credentials and encryption keys. Integrity is compromised through arbitrary kernel memory writes that can modify security controls. Availability can be affected through kernel corruption leading to system crashes. The EPSS score of 67.65% and the continued addition to the KEV catalog in 2022 demonstrate that this vulnerability remains actively targeted, particularly on unpatched Android devices.
Exploit Maturity
CISA added CVE-2013-6282 to the KEV catalog on September 15, 2022, confirming continued active exploitation nearly a decade after disclosure. The EPSS score of 67.65% (98.55th percentile) indicates very high exploitation probability. This vulnerability has been incorporated into numerous Android rooting tools and malware families targeting mobile devices. The long-standing nature of the vulnerability and the large number of unpatched Android devices ensure a substantial vulnerable population. The ransomware association is classified as unknown.
Remediation
- Update the Linux kernel: Apply the kernel patch (commit 8404663f81d2) that adds proper address validation to get_user and put_user on ARM platforms.
- Update Android devices: Ensure all Android devices are updated to firmware versions that include the kernel fix. Devices no longer receiving security updates should be retired.
- Restrict untrusted applications: On affected devices, limit the installation of applications to trusted sources and implement mobile device management (MDM) policies.
- Deploy mobile threat defense: Use mobile threat detection solutions to identify exploitation attempts on Android devices.
- Inventory vulnerable devices: Identify all ARM-based Linux and Android devices in the organization that may still be running vulnerable kernel versions and prioritize their replacement or update.
Technical Details
CVE-2013-6282 exists in the ARM architecture-specific implementation of the Linux kernel's get_user and put_user functions, which are used to copy data between user space and kernel space. On ARM v6k/v7 platforms, these functions fail to call the access_ok() macro to validate that the target address actually resides in user space before performing the memory copy operation. This missing address validation allows a local application to invoke these functions with kernel-space addresses, enabling direct reads from and writes to kernel memory. An attacker can exploit this to read sensitive kernel data structures, modify kernel security controls, and ultimately gain root privileges. The vulnerability is particularly impactful on Android devices using ARM processors, where it has been widely used for rooting and by malware.
Frequently Asked Questions
Is CVE-2013-6282 being actively exploited?
Yes, CVE-2013-6282 remains actively exploited despite being disclosed in 2013. CISA added it to the KEV catalog in September 2022, and the EPSS score of 67.65% confirms high exploitation activity, particularly targeting unpatched Android devices.
What products are affected by CVE-2013-6282?
CVE-2013-6282 affects the Linux kernel on ARM v6k/v7 platforms, which includes a vast number of Android smartphones and tablets, as well as ARM-based embedded Linux systems.
How do I fix CVE-2013-6282?
Update the Linux kernel to a version containing the address validation fix. For Android devices, apply the latest security updates. Devices that no longer receive updates should be retired.
How severe is CVE-2013-6282?
CVE-2013-6282 has an EPSS score of 67.65% (98.55th percentile) and enables local privilege escalation to root by reading and writing arbitrary kernel memory. The widespread presence of vulnerable ARM devices makes it a significant ongoing threat.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.