CVE-2013-2850

 

Published at: - 07-06-2013 04:03

Last modified: - 19-01-2023 04:48

Total changes: - 2

Description

Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet.

Common Vulnerability Scoring System (CVSS)

AV:A/AC:M/Au:N/C:C/I:C/A:C

 

Verification logic

 

Reference

• https://github.com/torvalds/linux/commit/cea4dcfdad926a27a18e188720efe0f2c9403456
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=cea4dcfdad926a27a18e188720efe0f2c9403456
• https://bugzilla.redhat.com/show_bug.cgi?id=968036
• [oss-security] 20130601 CVE-2013-2850: Linux kernel iSCSI target heap overflow-Mailing List
• openSUSE-SU-2013:1005-Mailing List, Third Party Advisory
• openSUSE-SU-2013:1042-Mailing List, Third Party Advisory
• openSUSE-SU-2013:1043-Mailing List, Third Party Advisory
• USN-1845-1-Third Party Advisory
• USN-1844-1-Third Party Advisory
• USN-1846-1-Third Party Advisory
• USN-1847-1-Third Party Advisory
• SUSE-SU-2013:0845-Mailing List, Third Party Advisory

 

Keywords

NVD

 

CVE-2013-2850

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures