CVE-2013-6282
High KEV — Actively ExploitedThe (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
CVSS 3.1 score
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness type
CWE-20CVE-2013-6282 is a Improper Input Validation vulnerability
What is Improper Input Validation?
The product receives input but does not validate it correctly, allowing attackers to craft inputs that cause unexpected behavior. Learn more on MITRE CWE
References
The following references provide additional information about CVE-2013-6282 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
Mailing List Vendor Advisory
-
Mailing List
-
Securityfocushttp://www.securityfocus.com/bid/63734Third Party Advisory VDB Entry
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-2067-1Third Party Advisory VDB Entry
-
Exploit-DBhttps://www.exploit-db.com/exploits/40975/Exploit Third Party Advisory VDB Entry
-
US Government Resource
-
PatchKernel patch commithttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04
-
PatchKernel patch commithttp://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282
-
PatchKernel patch commithttps://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04
Frequently asked questions
-
What is CVE-2013-6282?
CVE-2013-6282 is a High severity Linux kernel vulnerability with a CVSS score of 8.8 out of 10 , classified as an Improper Input Validation flaw (CWE-20) . CVE-2013-6282 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
-
What is the CVSS score for CVE-2013-6282?
CVE-2013-6282 has a CVSS score of 8.8 out of 10, rated High severity (CVSS 3.1). The vector string is
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. -
Is there a patch available for CVE-2013-6282?
No patch is currently available for CVE-2013-6282. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
-
Is CVE-2013-6282 actively exploited?
Yes — CVE-2013-6282 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. It carries a CVSS score of 8.8 (High severity).
-
What is Improper Input Validation (CWE-20)?
The product receives input but does not validate it correctly, allowing attackers to craft inputs that cause unexpected behavior. View CWE-20 on MITRE CWE →