CVE-2013-6282: linux kernel

csirt@kutim:~/threat-intel/cve/CVE-2013-6282

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 39,7%

Kerentanan Improper Input Validation pada linux kernel. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 15 September 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.

Rincian

Terbit di NVD: 20 November 2013
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
EPSS (30 hari): 39,7% peluang dieksploitasi; lebih tinggi dari 98,5% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Linux Kernel Improper Input Validation Vulnerability
Masuk KEV: 15 September 2022
Tenggat CISA: 6 Oktober 2022 (untuk instansi federal AS)
Ransomware: Belum tercatat
Tindakan wajib: Apply updates per vendor instructions.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
linux	linux kernel	Semua versi sebelum 3.2.54
linux	linux kernel	Versi 3.3 hingga sebelum 3.4.12
linux	linux kernel	Versi 3.5 hingga sebelum 3.5.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5 mailing list · advisory vendor
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7... patch
http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-201... patch
https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04 exploit · patch
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282 pemerintah AS
http://www.securityfocus.com/bid/63734 advisory pihak ketiga · vdb entry
http://www.ubuntu.com/usn/USN-2067-1 advisory pihak ketiga · vdb entry
https://www.exploit-db.com/exploits/40975/ exploit · advisory pihak ketiga · vdb entry
http://www.openwall.com/lists/oss-security/2013/11/14/11 mailing list

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.