vulnerability announce CVE-2013-4299
Linux kernel: information disclosure via device-mapper
Synthesis of the vulnerability
An attacker can create metadata via the device-mapper of the Linux kernel, in order to read the content of free disk blocks.Impacted products: Debian
, SUSE Linux Enterprise Desktop
1004233, BID-63183, CERTFR-2014-AVI-388, CVE-2013-4299, DSA-2906-1, RHSA-2013:1436-01, RHSA-2013:1449-01, RHSA-2013:1450-01, RHSA-2013:1490-01, RHSA-2013:1519-01, RHSA-2013:1520-01, RHSA-2013:1783-01, RHSA-2013:1860-01, SUSE-SU-2014:0908-1, SUSE-SU-2014:0909-1, SUSE-SU-2014:0910-1, SUSE-SU-2014:0911-1, SUSE-SU-2014:0912-1, SUSE-SU-2014:1105-1, VIGILANCE-VUL-13612.
Description of the vulnerability
The device-mapper subsystem is used to access to hard disks.
The Snapshot feature is used to create a fixed image, in order to save it for example, and allows the edition of data, which are synchronized later. However, the read_exceptions() function of the drivers/md/dm-snap-persistent.c file does not check if user's data contain metadata (control) data.
An attacker can therefore create metadata via the device-mapper of the Linux kernel, in order to read the content of free disk blocks.Complete Vigil@nce bulletin....
Share this bulletin
Computer vulnerabilities tracking service
Vigil@nce provides a software vulnerabilities announce
. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system. The Vigil@nce vulnerability database contains several thousand vulnerabilities. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.