Linux · Kernel
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
What it is
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
CISA: The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: October 6, 2022
- Added to the CISA list
- September 15, 2022
- Published
- November 19, 2013
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 40% in the top 1.4% of all known vulnerabilities
- Weakness
- CWE-20
- More details
- NVD · CVE.org · CISA
All references (8)
- http://www.ubuntu.com/usn/USN-2067-1
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5
- https://www.exploit-db.com/exploits/40975/
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a…
- http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-20…
- http://www.securityfocus.com/bid/63734
- http://www.openwall.com/lists/oss-security/2013/11/14/11
- https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04
More exploited flaws from Linux
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 18, 2026 | Improper Check for Unusual or Exceptional Conditions | Kernel | Critical 9.8 | 3.3% |
| Sep 18, 2026 | Race Condition | Kernel | High 7.8 | 1.6% |
| Sep 18, 2026 | Out-of-Bounds Write | Kernel | High 8.8 | 0.9% |
| Aug 27, 2026 | Unspecified | Kernel | High 7.8 | 0.7% |
| Aug 26, 2026 | Out-of-Bounds Write | Kernel | High 7.8 | 8.9% |
| Jun 2, 2026 | Improper Authentication | Kernel | High 7.8 | 5.5% |
| May 1, 2026 | Incorrect Resource Transfer Between Spheres | Kernel | High 7.8 | 98% |
| Jan 26, 2026 | Integer Overflow | Kernel | High 7.8 | 15% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.