Vulnerability Details : CVE-2013-2147
The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.
Products affected by CVE-2013-2147
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9:rc6:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9.1:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9.2:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9:rc7:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.9.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-2147
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 8 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-2147
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:P/I:N/A:N |
3.9
|
2.9
|
NIST |
CWE ids for CVE-2013-2147
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-2147
-
http://www.ubuntu.com/usn/USN-2020-1
USN-2020-1: Linux kernel (Raring HWE) vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-2023-1
USN-2023-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-1994-1
USN-1994-1: Linux kernel (Quantal HWE) vulnerability | Ubuntu security notices
-
http://rhn.redhat.com/errata/RHSA-2013-1166.html
RHSA-2013:1166 - Security Advisory - Red Hat Customer Portal
-
http://www.ubuntu.com/usn/USN-2050-1
USN-2050-1: Linux kernel (OMAP4) vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-2017-1
USN-2017-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://lkml.org/lkml/2013/6/3/127
LKML: Dan Carpenter: [patch] cciss: info leak in cciss_ioctl32_passthru()
-
https://bugzilla.redhat.com/show_bug.cgi?id=971242
971242 – (CVE-2013-2147) CVE-2013-2147 Kernel: cpqarray/cciss: information leak via ioctl
-
http://www.ubuntu.com/usn/USN-2016-1
USN-2016-1: Linux kernel (EC2) vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-1999-1
USN-1999-1: Linux kernel (OMAP4) vulnerability | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-1996-1
USN-1996-1: Linux kernel vulnerability | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-1997-1
USN-1997-1: Linux kernel (OMAP4) vulnerability | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-2015-1
USN-2015-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://www.openwall.com/lists/oss-security/2013/06/05/25
oss-security - Re: CVE request: kernel: cpqarray/c: info leak in ida_locked_ioctl()
-
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
[security-announce] SUSE-SU-2015:0812-1: important: Security update for
-
http://lkml.org/lkml/2013/6/3/131
LKML: Dan Carpenter: [patch] cpqarray: info leak in ida_locked_ioctl()
Jump to