{"id":"CVE-2013-2547","aliases":["BELL-CVE-2013-2547","DEBIAN-CVE-2013-2547","EUVD-2013-2489","GHSA-9558-m4h2-x96x","RHSA-2013:0829","UBUNTU-CVE-2013-2547"],"status":"published","title":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user...","description":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00417,"percentile":0.36245,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2013-03-14T20:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["3.2.41-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["3.2.41-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["3.2.41-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.41-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.41-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.41-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debug-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debug-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-debuginfo-common-x86_64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-firmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-trace","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-trace-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-trace-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-vanilla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-vanilla-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"kernel-rt-vanilla-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:enterprise_mrg:2:server:el6","package":"mrg-rt-release","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.11.2-rt33.39.el6rt"}]}],"bundled":21}],"products":[{"vendor":"linux","product":"linux_kernel"},{"vendor":"redhat","product":"enterprise_mrg"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-1796-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://github.com/torvalds/linux/commit/9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6","tags":["x_refsource_CONFIRM","x_transferred","fix"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:176","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1797-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/03/05/13","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1793-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1794-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1795-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2547","tags":["advisory"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6"},{"url":"https://github.com/advisories/GHSA-9558-m4h2-x96x"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2013-2547","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2547","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0829","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/site/solutions/373743","tags":["article"]},{"url":"https://rhn.redhat.com/errata/RHBA-2012-0044.html","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_MRG/2/html/Technical_Notes/RHSA-2013-0829.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915592","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=916191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=916646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=918009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=918098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=918512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=920471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=920499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=920783","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=921970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=924689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=924690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=927026","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=949932","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=955216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=955599","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=955629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=955649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=956094","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=956162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=962792","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0829.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0913","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0913","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0914","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0914","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1767","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1767","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1774","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1774","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1774","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1792","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1792","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1792","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1819","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1819","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1848","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1848","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1848","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1860","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1929","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1979","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1979","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2094","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2094","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2094","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2546","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2546","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2547","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2547","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2548","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2548","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2548","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2634","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2634","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2634","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2635","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-3076","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3076","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-3222","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3222","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3222","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-3224","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3224","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-3225","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3225","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3225","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-3231","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3231","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3231","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-2547","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/03/07","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-1793-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-1794-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-1795-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-1796-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-1797-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-2547","description":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.","status":"published","published":"2013-03-14T20:00:00Z","modified":"2024-08-06T15:44:32.059Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2489","description":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.","status":"published","published":"2013-03-14T20:00:00Z","modified":"2024-08-06T15:44:32Z","updated_at":"2026-11-03T01:56:38.194266Z"}],"ghsa":[{"id":"GHSA-9558-m4h2-x96x","title":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user...","description":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.","status":"published","published":"2022-05-13T01:08:42Z","modified":"2025-04-11T04:08:28Z","updated_at":"2026-11-02T15:01:13.537017Z"}],"nvd":[{"id":"CVE-2013-2547","description":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.","status":"published","published":"2013-03-15T20:55:08.633Z","modified":"2026-06-16T23:53:36.423Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:24.091325Z"}],"osv":[{"id":"BELL-CVE-2013-2547","title":"CVE-2013-2547 does not affect BellSoft software","status":"withdrawn","published":"2013-03-15T20:55:00Z","modified":"2026-01-28T07:20:04.327456Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2013-2547","description":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.","status":"published","published":"2013-03-15T20:55:08Z","modified":"2026-04-10T03:44:27.248842Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2547","description":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.","status":"published","published":"2013-03-15T20:55:08.633Z","modified":"2026-09-01T20:03:15.850441122Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"RHSA-2013:0829","title":"Red Hat Security Advisory: kernel-rt security and bug fix update","status":"published","published":"2024-09-13T08:25:57Z","modified":"2026-06-28T10:08:08Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-2547","description":"The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.","status":"withdrawn","published":"2013-03-15T00:00:00Z","modified":"2026-02-04T04:21:54.726913Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}