CVE-2013-6282
High · 8.8 CISA KEVCVSS
8.8
EPSS
39.7%
Published
Nov 20, 2013
CISA due date
Oct 6, 2022
The record
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | 3.6.4-1~experimental.1 |
| Debian:12 | linux | 0 | 3.6.4-1~experimental.1 |
| Debian:13 | linux | 0 | 3.6.4-1~experimental.1 |
| Ubuntu:14.04:LTS | linux | 0 | 3.11.0-12.19 |
| Ubuntu:14.04:LTS | linux-aws | 0 | 4.4.0-1002.2 |
| Ubuntu:14.04:LTS | linux-lts-utopic | 0 | 3.16.0-25.33~14.04.2 |
| Ubuntu:14.04:LTS | linux-lts-vivid | 0 | 3.19.0-18.18~14.04.1 |
| Ubuntu:14.04:LTS | linux-lts-wily | 0 | 4.2.0-18.22~14.04.1 |
| Ubuntu:14.04:LTS | linux-lts-xenial | 0 | 4.4.0-13.29~14.04.1 |
| Ubuntu:14.04:LTS | linux-manta | 0 | 3.4.0-5.22 |
| Ubuntu:16.04:LTS | linux | 0 | 4.2.0-16.19 |
| Ubuntu:16.04:LTS | linux-aws | 0 | 4.4.0-1001.10 |
| Ubuntu:16.04:LTS | linux-gke | 0 | 4.4.0-1003.3 |
| Ubuntu:16.04:LTS | linux-goldfish | 0 | 3.4.0-4.27 |
| Ubuntu:16.04:LTS | linux-hwe | 0 | 4.8.0-36.36~16.04.1 |
| Ubuntu:16.04:LTS | linux-raspi2 | 0 | 4.2.0-1013.19 |
| Ubuntu:16.04:LTS | linux-snapdragon | 0 | 4.4.0-1012.12 |
| Ubuntu:Pro:14.04:LTS | linux-flo | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | linux-goldfish | 0 | No fix |
| Ubuntu:Pro:14.04:LTS | linux-mako | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-flo | 0 | No fix |
| Ubuntu:Pro:16.04:LTS | linux-mako | 0 | No fix |
Related vulnerabilities
- CVE-2025-38562 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
- CVE-2025-38352 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix… Also affects linux
- CVE-2025-22037 In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null… Also affects linux
- CVE-2025-21760 In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU… Also affects linux
- CVE-2025-21758 In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU… Also affects linux
- CVE-2025-21664 In the Linux kernel, the following vulnerability has been resolved: dm thin: make… Also affects linux
- CVE-2024-57946 In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't… Also affects linux
- CVE-2024-57945 In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the… Also affects linux