Vulnerability Details : CVE-2013-6282

Public exploit exists!
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
Published 2013-11-20 13:19:43
Updated 2025-04-11 00:51:22
Source MITRE
View at NVD,   CVE.org

Products affected by CVE-2013-6282

Threat overview for CVE-2013-6282

Top countries where our scanners detected CVE-2013-6282
Top open port discovered on systems with this issue 49152
IPs affected by CVE-2013-6282 158,793
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2013-6282!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

CVE-2013-6282 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Linux Kernel Improper Input Validation Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
Notes:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8404663f81d212918ff85f493649a7991209fa04; https://nvd.nist.gov/vuln/detail/CVE-2013-6282
Added on 2022-09-15 Action due date 2022-10-06

Exploit prediction scoring system (EPSS) score for CVE-2013-6282

EPSS FAQ
46.92%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2013-6282

  • Android get_user/put_user Exploit
    Disclosure Date: 2013-09-06
    First seen: 2020-04-26
    exploit/android/local/put_user_vroot
    This module exploits a missing check in the get_user and put_user API functions in the linux kernel before 3.5.5. The missing checks on these functions allow an unprivileged user to read and write kernel memory. This exploit first reads the kernel mem

CVSS scores for CVE-2013-6282

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.2
 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C
3.9
10.0
 NIST
8.8
 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
 134c704f-9b21-4f2e-91b3-4a467353bcc0 2025-02-03
8.8
 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
 NIST 2025-02-04

CWE ids for CVE-2013-6282

  • The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
    Assigned by:
    • 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
    • nvd@nist.gov (Primary)

References for CVE-2013-6282

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close