oss-sec mailing list archives
CVE split and a missed file
From: P J P <ppandit () redhat com>
Date: Tue, 7 Jan 2014 13:04:29 +0530 (IST)
Hello,Recently Mitre split up a cve 'CVE-2013-6405' into 3 separate CVEs. Each for subset of files touched by a commit 'bceaa90240'.
-> https://git.kernel.org/linus/bceaa90240b6019ed73b49965eac7d167610be69 But the 3 new CVEs do not seem to cover patch to a file -> net/ieee802154/dgram.c. Is that intentional or a miss. (just checking) === Name: CVE-2013-6405 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6405 [Open URL] Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20131104 Category: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-7263, CVE-2013-7264, CVE-2013-7265. Reason: This candidate is a duplicate of CVE-2013-7263, CVE-2013-7264, and CVE-2013-7265. Notes: All CVE users should reference CVE-2013-7263, CVE-2013-7264, and/or CVE-2013-7265 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. -- CVE-2013-7263 The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c. -- CVE-2013-7264 The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. -- CVE-2013-7265 The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call. === Thank you. -- Prasad J Pandit / Red Hat Security Response Team
Current thread:
- CVE split and a missed file P J P (Jan 06)
- Re: CVE split and a missed file P J P (Jan 07)
- Re: CVE split and a missed file cve-assign (Jan 08)
- Re: CVE split and a missed file P J P (Jan 09)
- RE: CVE split and a missed file Christey, Steven M. (Jan 09)
- Re: CVE split and a missed file cve-assign (Jan 09)
- Re: CVE split and a missed file cve-assign (Jan 08)
- Re: CVE split and a missed file P J P (Jan 07)
- Re: CVE split and a missed file cve-assign (Jan 08)