Vulnerability record · CVE-2013-6282 · published 20 November 2013
CVE-2013-6282: Linux kernel ARM get_user/put_user missing address validation
Linux · Linux Kernel
The get_user and put_user API functions in the Linux kernel before 3.5.5 on v6k and v7 ARM platforms fail to validate certain addresses, allowing crafted applications to read or modify arbitrary kernel memory. This is a memory-corruption class flaw that undermines kernel isolation on affected ARM devices.
Description
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and public exploit code, though it affects older ARM kernels and requires local low-privileged access.
What it is
The get_user and put_user API functions in the Linux kernel before 3.5.5 on v6k and v7 ARM platforms fail to validate certain addresses, allowing crafted applications to read or modify arbitrary kernel memory. This is a memory-corruption class flaw that undermines kernel isolation on affected ARM devices.
Impact
An attacker gains read and write access to arbitrary kernel memory, which can lead to privilege escalation and full compromise of the device. The CVSS 3.1 vector rates confidentiality, integrity and availability impact all High.
Attack surface
Reached locally by a crafted application running on the device; the CVSS vector AV:N/PR:L/UI:N indicates a network-reachable path requiring low privileges and no user interaction, though the description frames the trigger as a crafted application. No authentication beyond low privilege is needed.
Exploitation
CISA KEV lists it as exploited in the wild, with exploitation against Android devices observed in October and November 2013, and EPSS shows a 30-day probability of 0.397 (98.5th percentile). Public exploit code exists via Exploit-DB and the upstream commit reference.
What to do
- Apply the upstream kernel patch (commit 8404663f81d212918ff85f493649a7991209fa04) or upgrade to Linux kernel 3.5.5 or later.
- Apply vendor updates for affected ARM distributions and Android builds per vendor instructions, as required by CISA KEV.
- Restrict installation and execution of untrusted applications on affected ARM devices.
- Where patching is not possible, isolate or retire affected ARM devices from sensitive networks.
Detection
- Monitor for unexpected kernel memory access patterns or crashes on ARM v6k/v7 devices.
- Audit application installs and execution on affected devices for untrusted or sideloaded apps.
- Track patch status of ARM kernels against the 3.5.5 baseline and vendor advisories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2013-6282 to the Known Exploited Vulnerabilities catalog on 15 September 2022 as "Linux Kernel Improper Input Validation Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 6 October 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-6282 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-6282), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
