CVE-2013-6282
- State
- Published
- Severity
- 8.8 High
- Published
- Nov 19, 2013
- Updated
- Oct 22, 2025
- Reserved
- Oct 25, 2013
Description
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-20 Improper Input Validation
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5
- 40975exploit
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04
- http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282
- 63734vdb-entry
- [oss-security] 20131114 CVE-2013-6282 - linux kernel: missing access checks in get_user/put_user on ARMmailing-list
- https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04
- USN-2067-1vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.