Description
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.2.41-1 | — |
| Debian 13 | linux | 3.2.41-1 | — |
| Debian 12 | linux | 3.2.41-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | kernel-rt +11 | 3.6.11.2-rt33.39.el6rt | RHSA-2013:0829 |
Advisories 1
- RHSA-2013:0829 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- USN-1796-1 vendor-advisory
- https://github.com/torvalds/linux/commit/9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6
- MDVSA-2013:176 vendor-advisory
- USN-1797-1 vendor-advisory
- [oss-security] 20130305 CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs mailing-list
- USN-1793-1 vendor-advisory
- openSUSE-SU-2013:1971 vendor-advisory
- USN-1794-1 vendor-advisory
- USN-1795-1 vendor-advisory