CVE-2013-1772
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not...
CVE-2013-1772 is a medium vulnerability (CVSS 4.0) in Linux Kernel, published February 28, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in linux 3.2.39-1.
- Severity
- 4.0 MediumCVSS 2.0, NVD
- Exploit chance
- 0.38%EPSS, 32nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.2.39-1linux +18 more
Description
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linuxDebian:12 | before 3.2.39-1 | 3.2.39-1 |
linuxDebian:13 | before 3.2.39-1 | 3.2.39-1 |
linuxDebian:14 | before 3.2.39-1 | 3.2.39-1 |
kernel-rtRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-debugRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-debug-debuginfoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-debug-develRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-debuginfoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-debuginfo-common-x86_64Red Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-develRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-rt-docRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-firmwareRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-traceRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-trace-debuginfoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-trace-develRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-vanillaRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-vanilla-debuginfoRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
kernel-rt-vanilla-develRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
mrg-rt-releaseRed Hat:enterprise_mrg:2:server:el6 From an advisory covering 4 CVEs | before 0:3.6.11-rt28.20.el6rt | 0:3.6.11-rt28.20.el6rt |
What each source reports
NVD Score used
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
- Record
CVE-2013-1772- CVSS 2.0
- 4.0 Medium
AV:L/AC:H/Au:N/C:N/I:N/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
- Record
CVE-2013-1772- Updated
- 2026-11-02
EUVDEUVD-2013-1797No score
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
- Record
EUVD-2013-1797- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-58hg-m3wr-hj5rNo score
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not...
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
- Record
GHSA-58hg-m3wr-hj5r- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
- Record
CVE-2013-1772- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1772No score
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
- Record
DEBIAN-CVE-2013-1772- Updated
- 2026-11-02
OSVSUSE-SU-2015:0481-1No score
Security update for Linux kernel
The SUSE Linux Enterprise 11 Service Pack 2 kernel was updated to fix a regression introduced by the previous update:
* scsi_dh_alua: Incorrect reference counting in the SCSI ALUA
initialization code lead to system crashes on boot (bnc#858831).
As the update introducing the regression was marked security, this is also marked security even though this bug is not security relevant.
- Record
SUSE-SU-2015:0481-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-1772No score
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
- Record
UBUNTU-CVE-2013-1772- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/torvalds/linux/commit/ce0030c00f95cf9110d9cdcd41e901e1fb814417
lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html
openwall.com/lists/oss-security/2013/02/26/9
bugzilla.redhat.com/show_bug.cgi?id=916075
kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.33
nvd.nist.gov/vuln/detail/CVE-2013-1772
Show 194 moreShow less
security-tracker.debian.org/tracker/CVE-2013-1772
access.redhat.com/errata/RHSA-2013:0566
rhn.redhat.com/errata/RHSA-2012-0333.html
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0566.json
cve.org/CVERecord?id=CVE-2012-2375
suse.com/support/update/announcement/2015/suse-su-20150481-1
bugzilla.suse.com/556135
ubuntu.com/security/CVE-2013-1772
Left out here: 844 references. The JSON record has them.