QwikSec

Security Database

CVE

CWE

Training

CVE-2013-6282

Published: Nov 19, 2013

Modified: Oct 22, 2025

PUBLISHED

Description

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5

x_refsource_CONFIRM

exploit

x_refsource_EXPLOIT-DB

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04

x_refsource_CONFIRM

http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

[oss-security] 20131114 CVE-2013-6282 - linux kernel: missing access checks in get_user/put_user on ARM

mailing-list

x_refsource_MLIST

https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04

x_refsource_CONFIRM

vendor-advisory

x_refsource_UBUNTU

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.