High severity · published Nov 19, 2013
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
In wildKEV
8.8
CVSS
39.7%
EPSS
Yes
On KEV
Description
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)39.7% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 15, 2022
Federal remediation dueOct 6, 2022
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
before 3.2.54; 3.3 before 3.4.12; 3.5 before 3.5.5 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-6282
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-6282
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5
exploit
https://www.exploit-db.com/exploits/40975/
x_refsource_CONFIRM
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04
x_refsource_CONFIRM
http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282
vdb-entry
http://www.securityfocus.com/bid/63734
mailing-list
http://www.openwall.com/lists/oss-security/2013/11/14/11
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path