CVE-2013-4345

Error de superación en la función get_prng_bytes en crypto/ansi_cprng.c en el kernel de Linux hasta la versión 3.11.4 hace que sea más fácil para atacantes dependientes del contexto anular mecanismos de protección criptográficos a través de múltiples peticiones por pequeñas cantidades de datos, que conduce a la gestión inadecuada del estado de los datos consumidos.

The kernel packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way the Linux kernel handled the creation of temporary IPv6 addresses. If the IPv6 privacy extension was enabled, an attacker on the local network could disable IPv6 temporary address generation, leading to a potential information disclosure. An information leak flaw was found in the way Linux kernel's device mapper subsystem, under certain conditions, interpreted data written to snapshot block devices. An attacker could use this flaw to read data from disk blocks in free space, which are normally inaccessible.