# CVE-2013-6282

The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.

- Page: https://www.vulneraibility.com/cve/CVE-2013-6282
- CVSS: 8.8
- Known exploited: yes, in CISA KEV since 2022-09-15; CISA due date 2022-10-06
- EPSS: 39.71% (percentile 98.6)
- Public exploit code: 3 on Exploit-DB · 1 Metasploit module · 4 GitHub proofs of concept (first 2013-11-18)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-05-01)
- Weakness: CWE-20
- Published: 2013-11-20

## Affected

- linux:linux_kernel

## References

- [other] http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5
- [exploit] https://www.exploit-db.com/exploits/40975/
- [other] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04
- [other] http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282
- [other] http://www.securityfocus.com/bid/63734
- [other] http://www.openwall.com/lists/oss-security/2013/11/14/11
- [other] https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04
- [advisory] http://www.ubuntu.com/usn/USN-2067-1
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.