Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Linux kernel before 3.8.11 lets local app gain extra privileges

CVE-2013-1979 · published 13 years ago
Summary

Versions of the Linux kernel earlier than 3.8.11 mishandle user and group identifiers when passing credentials between processes. This mistake can be exploited by someone with local access who runs a specially crafted program to obtain higher system rights. Upgrade the kernel to version 3.8.11 or later, or apply the provided security patch, to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
linux linux_kernel <= 3.8.10
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.8.8
3.8.9
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Original advisory text
The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a craf...
The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published3 May 2013
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-1979 · NVD
Track software like this
Free during beta