CVE-2013-6282
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and...
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- Record
CVE-2013-6282- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- Record
CVE-2013-6282- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2013-6110
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- Record
EUVD-2013-6110- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7p8v-5r94-xc7r
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and...
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- Record
GHSA-7p8v-5r94-xc7r- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
CISA KEV No score
Linux Kernel Improper Input Validation Vulnerability
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
- Record
CVE-2013-6282- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVBELL-CVE-2013-6282
CVE-2013-6282 does not affect BellSoft software
- Record
BELL-CVE-2013-6282- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- Record
CVE-2013-6282- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6282
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- Record
DEBIAN-CVE-2013-6282- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6282
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
- Record
UBUNTU-CVE-2013-6282- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Android get_user/put_user Exploit | 2013-09-06 |
| PoC in GitHub | fi01/libput_user_exploit | 2013-11-18 |
| PoC in GitHub | fi01/libget_user_exploit | 2013-11-28 |
| PoC in GitHub | jeboo/bypasslkm | 2013-12-21 |
| Exploit-DB | Linux Kernel < 3.4.5 (Android 4.2.2/4.4 ARM) - Local Privilege Escalation | 2014-02-11 |
| PoC in GitHub | timwr/CVE-2013-6282 | 2016-12-19 |
| Exploit-DB | Google Android - get_user/put_user (Metasploit) | 2016-12-29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| affected | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6282 is a high vulnerability (CVSS 8.8) in Linux Kernel, published November 19, 2013. CISA lists it as known to be exploited, since September 15, 2022. EUVD reports exploitation since September 15, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 39.7%, the 98th percentile. Fixed in linux 3.6.4-1~experimental.1.
References
kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5
exploit-db.com/exploits/40975
git.kernel.org?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04
codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282
securityfocus.com/bid/63734
openwall.com/lists/oss-security/2013/11/14/11
Show 13 moreShow less
github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04
ubuntu.com/usn/USN-2067-1
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282
nvd.nist.gov/vuln/detail/CVE-2013-6282
docs.bell-sw.com/security/cves/CVE-2013-6282
security-tracker.debian.org/tracker/CVE-2013-6282
ubuntu.com/security/CVE-2013-6282
cve.org/CVERecord?id=CVE-2013-6282