Description
Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | kernel-rt +11 | 3.6.11-rt30.25.el6rt | RHSA-2013:0622 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 4
- Linux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation EDB-44299 · local · Aug 26, 2015
- Linux Kernel 3.7.10 (Ubuntu 12.10 x64) - 'sock_diag_handlers' Local Privilege Escalation (2) EDB-24746 · local · Mar 13, 2013
- Linux Kernel 3.3.x < 3.7.x (Arch Linux x86-64) - 'sock_diag_handlers[]' Local Privilege Escalation (1) EDB-24555 · local · Feb 27, 2013
- Linux Kernel 3.3 < 3.8 (Ubuntu / Fedora 18) - 'sock_diag_handlers()' Local Privilege Escalation (3) EDB-33336 · local · Feb 24, 2013 · verified
GitHub 1 repository
-
qkrtjsrbs315/CVE-2013-1763 ★ 0 · Feb 1, 2022
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2013:0622 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=915052
- https://github.com/torvalds/linux/commit/6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
- [oss-security] 20130225 Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] mailing-list
- MDVSA-2013:176 vendor-advisory
- USN-1750-1 vendor-advisory
- 33336 exploit
- [oss-security] 20130224 Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[] mailing-list
- openSUSE-SU-2013:0395 vendor-advisory
- 24746 exploit
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.10
- USN-1749-1 vendor-advisory
- 24555 exploit
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0
- USN-1751-1 vendor-advisory