CVE-2013-4343
MediumUse-after-free vulnerability in drivers/net/tun.c in the Linux kernel through 3.11.1 allows local users to gain privileges by leveraging the CAP_NET_ADMIN capability and providing an invalid tuntap interface name in a TUNSETIFF ioctl call.
CVSS 2.0 score
6.9
AV:L/AC:M/Au:N/C:C/I:C/A:C
Weakness type
CWE-399CVE-2013-4343 is classified as CWE-399
See CWE-399 on MITRE CWE for full details on this weakness type.
References
The following references provide additional information about CVE-2013-4343 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Third Party Advisory
-
Mailing List Third Party Advisory
-
Third Party Advisory
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-2020-1Third Party Advisory
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-2023-1Third Party Advisory
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-2049-1Third Party Advisory
-
Issue Tracking Third Party Advisory
Frequently asked questions
-
What is CVE-2013-4343?
CVE-2013-4343 is a Medium severity Linux kernel vulnerability with a CVSS score of 6.9 out of 10 . CVE-2013-4343 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
What is the CVSS score for CVE-2013-4343?
CVE-2013-4343 has a CVSS score of 6.9 out of 10, rated Medium severity (CVSS 2.0). The vector string is
AV:L/AC:M/Au:N/C:C/I:C/A:C. -
Is there a patch available for CVE-2013-4343?
No patch is currently available for CVE-2013-4343. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
-
Is CVE-2013-4343 actively exploited?
No — CVE-2013-4343 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.