Vulnerability CVE-2013-7445

Vulnerability Name:

CVE-2013-7445 (CCN-110367)

Assigned:

2013-07-08

Published:

2013-07-08

Updated:

2015-10-16

Summary:

The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated by JavaScript code that creates many CANVAS elements for rendering by Chrome or Firefox.

CVSS v3 Severity:

7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

CVSS v2 Severity:

7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
6.6 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:U/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
6.6 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:U/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

Vulnerability Type:

CWE-399

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2013-7445

Source: CCN
Type: Kernel Bug Tracker Bug 60533
CVE-2013-7445: Remote web page triggerable DOS in Linux DRM graphics

Source: MISC
Type: UNKNOWN
https://bugzilla.kernel.org/show_bug.cgi?id=60533

Source: XF
Type: UNKNOWN
linux-kernel-cve20137445-dos(110367)

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-7445

Vulnerable Configuration:

Configuration 1:

cpe:/o:linux:linux_kernel:*:*:*:*:*:*:*:* (Version <= 4.0.0)

OR cpe:/o:linux:linux_kernel:4.0.1:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.0.2:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.0.3:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.0.4:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.0.5:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.0.6:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.0.7:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.0.8:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.0.9:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.1:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.2:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.3:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.4:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.5:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.6:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.7:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.8:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.9:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.1.10:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.2.1:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.2.2:*:*:*:*:*:*:*

OR cpe:/o:linux:linux_kernel:4.2.3:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:linux:linux_kernel:4.0.5:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.bionic:def:201374450000000	V	CVE-2013-7445 on Ubuntu 18.04 LTS (bionic) - medium.	2015-10-16
oval:com.ubuntu.xenial:def:201374450000000	V	CVE-2013-7445 on Ubuntu 16.04 LTS (xenial) - medium.	2015-10-16
oval:com.ubuntu.disco:def:201374450000000	V	CVE-2013-7445 on Ubuntu 19.04 (disco) - medium.	2015-10-16
oval:com.ubuntu.artful:def:20137445000	V	CVE-2013-7445 on Ubuntu 17.10 (artful) - medium.	2015-10-15
oval:com.ubuntu.trusty:def:20137445000	V	CVE-2013-7445 on Ubuntu 14.04 LTS (trusty) - medium.	2015-10-15
oval:com.ubuntu.bionic:def:20137445000	V	CVE-2013-7445 on Ubuntu 18.04 LTS (bionic) - medium.	2015-10-15
oval:com.ubuntu.xenial:def:20137445000	V	CVE-2013-7445 on Ubuntu 16.04 LTS (xenial) - medium.	2015-10-15
oval:com.ubuntu.cosmic:def:20137445000	V	CVE-2013-7445 on Ubuntu 18.10 (cosmic) - medium.	2015-10-15
oval:com.ubuntu.cosmic:def:201374450000000	V	CVE-2013-7445 on Ubuntu 18.10 (cosmic) - medium.	2015-10-15
oval:com.ubuntu.precise:def:20137445000	V	CVE-2013-7445 on Ubuntu 12.04 LTS (precise) - medium.	2015-10-15

BACK