What is CVE-2013-1929?

CVE-2013-1929 is a vulnerability in Linux Kernel, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2013-06-07.

Is CVE-2013-1929 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Linux Kernel

CVE-2013-1929

Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure.

Vulnerability class: Buffer Overflow

EPSS: 0.007 (50.1th percentile) — read the EPSS interpretation.

Affected products

Linux Linux_kernel — versions 3.8.0, 3.8.1, 3.8.2
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

References

secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
secalert@redhat.com (Exploit, x_refsource_MISC)
secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (vendor-advisory, x_refsource_SUSE)

Frequently asked questions

What is CVE-2013-1929?: CVE-2013-1929 is a vulnerability in Linux Kernel, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2013-06-07.
Is CVE-2013-1929 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.