CVEvulnerability

CVE-2013-2851

6.0 MEDIUM Published 2013-06-07 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-06-07
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:L/AC:H/Au:S/C:C/I:C/A:C
Weaknesses
CWE-134

Description

Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name.

Affected configurations

• linux linux kernel (<= 3.9.4) • linux linux kernel 3.9 • linux linux kernel 3.9.0 • linux linux kernel 3.9.1 • linux linux kernel 3.9.2 • linux linux kernel 3.9.3

Related

Weakness · CWE (1)

  • CWE-134 Use of Externally-Controlled Format String weakness

References