VULNERABILITY INTELLIGENCE
CVE-2013-3076
CVSS score4.9 MEDIUM
EPSS probability0.35%
CISA KEVNot currently listed
Published2013-04-22
Last modified2026-06-16
CVSS vectorAV:L/AC:L/Au:N/C:C/I:N/A:N
Description
The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor