{"id":"CVE-2013-6282","published":"2013-11-20T13:19:43Z","modified":"2026-06-17T00:00:14Z","title":"Linux Kernel Improper Input Validation Vulnerability","vendor":"Linux","product":"Kernel","tier":"core","eol":null,"description":{"text":"The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.","provenance":"source","from":"NVD"},"summary":{"text":"The Linux kernel before 3.5.5 on ARM v6k and v7 platforms has an improper input validation flaw in its get_user and put_user API functions, which fail to validate certain addresses. An attacker able to run a crafted application on an affected system, with low privileges and no user interaction, can read or modify arbitrary kernel memory locations.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:31Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.39711,"percentile":0.98617,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-09-15","dueDate":"2022-10-06","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8404663f81d212918ff85f493649a7991209fa04; https://nvd.nist.gov/vuln/detail/CVE-2013-6282","provenance":"source"},"vulncheckKev":{"dateAdded":"2013-11-19","exploitedFirstSeen":"2013-11-19","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6282","date":"2013-11-19"},{"url":"https://ubuntu.com/security/CVE-2013-6282","date":"2013-11-20"},{"url":"https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/","date":"2018-01-16"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-09-15"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04","tags":["Patch"]},{"url":"http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282","tags":["Patch"]},{"url":"http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/11/14/11","tags":["Mailing List"]},{"url":"http://www.securityfocus.com/bid/63734","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2067-1","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04","tags":["Exploit","Patch"]},{"url":"https://www.exploit-db.com/exploits/40975/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04","tags":["Patch"]},{"url":"http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282","tags":["Patch"]},{"url":"http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/11/14/11","tags":["Mailing List"]},{"url":"http://www.securityfocus.com/bid/63734","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.ubuntu.com/usn/USN-2067-1","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04","tags":["Exploit","Patch"]},{"url":"https://www.exploit-db.com/exploits/40975/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282","tags":["US Government Resource"]}],"techniques":[{"id":"T1608","name":"Stage Capabilities","tactics":["resource-development"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: kernel memory corruption grants local privilege escalation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"do not validate certain addresses, which allows attackers to read or modify","start":113,"end":188}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary kernel memory read from local data","mappingType":"primary_impact","evidence":[{"from":"description","quote":"read or modify the contents of arbitrary kernel memory locations","start":174,"end":238}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2013-6110","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-6110","exploited":true,"exploitedSince":"2022-09-15","provenance":"source"},"exploits":[{"id":31574,"url":"https://www.exploit-db.com/exploits/31574","title":"Linux Kernel < 3.4.5 (Android 4.2.2/4.4 ARM) - Local Privilege Escalation","type":"local","platform":"arm","date":"2014-02-11","verified":false,"provenance":"source"},{"id":40975,"url":"https://www.exploit-db.com/exploits/40975","title":"Google Android - get_user/put_user (Metasploit)","type":"local","platform":"android","date":"2016-12-29","verified":true,"provenance":"source"},{"id":40975,"url":"https://www.exploit-db.com/exploits/40975","title":"Google Android - get_user/put_user (Metasploit)","type":"local","platform":"android","date":"2016-12-29","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2014-02-11"},"pocGithub":{"count":4,"skipped":0,"earliest":"2013-11-18","earliestUrl":"https://github.com/fi01/libput_user_exploit","repos":[{"name":"fi01/libput_user_exploit","url":"https://github.com/fi01/libput_user_exploit","stars":28,"created":"2013-11-18"},{"name":"timwr/CVE-2013-6282","url":"https://github.com/timwr/CVE-2013-6282","stars":21,"created":"2016-12-19"},{"name":"jeboo/bypasslkm","url":"https://github.com/jeboo/bypasslkm","stars":12,"created":"2013-12-21"},{"name":"fi01/libget_user_exploit","url":"https://github.com/fi01/libget_user_exploit","stars":8,"created":"2013-11-28"}]},"metasploit":[{"name":"Android get_user/put_user Exploit","module":"exploit/android/local/put_user_vroot","type":"exploit","disclosureDate":"2013-09-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/local/put_user_vroot.rb"}],"first":{"date":"2013-09-06","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/local/put_user_vroot.rb"},"provenance":"source"},"exploitRefs":["https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04","https://www.exploit-db.com/exploits/40975/"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"},{"stage":"related","techniques":["T1608"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2013-09-06","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2013-11-18, Exploit-DB 2014-02-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/local/put_user_vroot.rb","provenance":"source"},{"date":"2013-11-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2013-6282","provenance":"source"},{"date":"2013-11-20","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6282","provenance":"source"},{"date":"2022-09-15","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-09-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-6110","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":3221},"priority":{"score":68.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4727 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.72,"detail":"percentile 0.9862"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 3 Exploit-DB entries; 4 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}