What is CVE-2013-1956?

CVE-2013-1956 is a vulnerability in Linux Kernel, classified under CWE-264. Published 2013-04-24.

Is CVE-2013-1956 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Linux Kernel

CVE-2013-1956

The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call.

EPSS: 0.004 (31.0th percentile) — read the EPSS interpretation.

Affected products

Linux Linux_kernel — versions 3.8.0, 3.8.1, 3.8.2
N/a — versions n/a

Weakness classification (CWE)

CWE-264

Public proof-of-concept exploits

ARPSyndicate/cvemon

References

secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2013-1956?: CVE-2013-1956 is a vulnerability in Linux Kernel, classified under CWE-264. Published 2013-04-24.
Is CVE-2013-1956 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.