HowToFixMe
● High · CVSS 8.8 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2013-6282: Improper Input Validation in Kernel

By the Sai Kiran Pandrala · Reviewed and edited by Sai Kiran Pandrala, Editor

⚡ At a glance
SeverityCVSS 8.8 - High
Actively exploited?Yes, listed in CISA KEV (added 2022-09-15); used in the wild to root Android devices in Oct-Nov 2013
AffectedLinux kernel before 3.5.5 on ARM v6k and v7 platforms (the get_user / put_user API)
Fixed inLinux kernel 3.5.5 (upstream commit 8404663f81d2)
Type (CWE)CWE-20 Improper Input Validation: local kernel memory read/write, leading to privilege escalation

Exploitation status

CVE-2013-6282 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on as “Linux Kernel Improper Input Validation Vulnerability”, which makes patching mandatory for U.S. federal agencies under Binding Operational Directive 22-01. Federal agencies were required to remediate it by . If you run an affected system, treat this as an emergency change, not a scheduled one.

Public exploit availability: a public exploit on Exploit-DB has been published. Assume opportunistic scanning and weaponization; prioritize accordingly.

Authoritative references:

Patch immediately. CISA's Known Exploited Vulnerabilities catalog lists this CVE, which means active exploitation has been confirmed. CISA KEV entry added 2022-09-15, federal due date 2022-10-06.

What is CVE-2013-6282?

CVE-2013-6282 is a missing access-check flaw in the Linux kernel's get_user and put_user API functions on the v6k and v7 ARM platforms, in every kernel built before version 3.5.5. Those two helpers are how kernel code copies a single value to or from a userspace pointer. On affected ARM builds they failed to validate that the supplied address actually belonged to userspace. A crafted application could therefore hand the kernel a pointer into kernel memory and have the kernel read from or write to it on the attacker's behalf.

That single missing check turns into an arbitrary kernel-memory read and write primitive. With it, a local process can overwrite its own credential structure, flip a function pointer, or otherwise rewrite kernel state and escalate from an unprivileged app to root. This is a local privilege escalation, not a remote network exploit, the attacker already has to be running code on the device. The high CVSS 8.8 score reflects the total compromise that follows once an unprivileged process can read and write kernel memory at will.

The CWE-20 (Improper Input Validation) classification fits exactly: the kernel trusted an address it should have range-checked. The MITRE record notes this was exploited in the wild against Android devices in October and November 2013, because virtually every Android phone of that era shipped a 32-bit ARM kernel older than 3.5.5. It became a staple primitive in the one-click rooting tools of that period.

Why this CVE matters

CISA added CVE-2013-6282 to the Known Exploited Vulnerabilities catalog on 2022-09-15. nine years after disclosure, because it was still being chained into active mobile-malware and rooting toolkits long after the fix shipped. A working exploit is published on Exploit-DB (entry 40975), so there is no skill barrier to reusing it.

The practical risk today lives on anything still running an unpatched pre-3.5.5 ARM kernel: legacy Android handsets, embedded ARM appliances, IoT gateways, set-top boxes, and industrial devices whose vendors never shipped a kernel update. On those targets, any app or local foothold: a malicious APK, a compromised service, a sandboxed process, can use this bug to gain full kernel control. If you operate a fleet of older 32-bit ARM Linux devices, treat each unpatched unit as a one-step path from unprivileged code to root.

Identify whether you are affected

This bug is specific to 32-bit ARM (v6k and v7) kernels older than 3.5.5. Check the running kernel version and the architecture. If the machine reports an armv6 / armv7 architecture and a kernel below 3.5.5, it is vulnerable.

# Kernel version and CPU architecture
uname -r        # e.g. 3.4.0 -> older than 3.5.5, vulnerable on ARM
uname -m        # armv7l or armv6 means this CVE applies; x86_64/aarch64 do not

# On Android (via adb shell), the same two checks:
adb shell uname -r
adb shell getprop ro.build.version.release

Note that 64-bit (aarch64) and x86/x86_64 kernels are not affected. the missing check was in the 32-bit ARM get_user/put_user implementation. If uname -m returns x86_64 or aarch64, this particular CVE does not apply to that host.

How to fix CVE-2013-6282

The fix landed in Linux kernel 3.5.5 (upstream commit 8404663f81d212918ff85f493649a7991209fa04), which adds the missing address range check to the ARM get_user and put_user paths. Code Aurora and the Android vendors backported the same patch into their 3.0.x and 3.4.x branches. The only durable fix is to run a kernel that contains commit 8404663, there is no userspace package to upgrade and no Windows component involved, so ignore any generic "upgrade the package" advice for this CVE.

General-purpose Linux distributions (Debian / Ubuntu / RHEL)

If this is a desktop or server distribution rather than an embedded image, install the distribution's patched kernel and reboot into it. Ubuntu shipped the fix in USN-2067-1. Use the actual kernel meta-package for your distro:

# Debian / Ubuntu: install the latest patched kernel image and reboot
sudo apt-get update
sudo apt-get install --only-upgrade linux-image-$(uname -r | sed 's/^[^-]*-//') linux-generic
sudo reboot

# RHEL / CentOS / Rocky, update the kernel package and reboot
sudo dnf update kernel
sudo reboot

After the reboot, run uname -r and confirm the running kernel is 3.5.5 or later (or a distro build that carries the backported commit 8404663).

Embedded / custom ARM kernel (build from source)

Most affected systems are embedded ARM devices running a vendor kernel tree, so the realistic fix is to rebuild the kernel with the patch. Pull at least 3.5.5, or cherry-pick the single upstream commit into your existing branch:

# Cherry-pick the exact fix into an older ARM kernel tree
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
git cherry-pick 8404663f81d212918ff85f493649a7991209fa04

# Rebuild for your ARM target and flash/deploy the new zImage
make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf- -j"$(nproc)" zImage modules

Android devices

On Android the kernel ships as part of the firmware, so you cannot patch it from inside the OS. The fix is an OEM firmware/OTA update that includes the backported commit:

After applying the kernel update, reboot the device so the new kernel is actually running. a patched kernel image on disk does nothing until it is the booted kernel.

If you can't patch immediately

A patched kernel is the only real fix, this is a kernel memory-safety bug, so there is no firewall rule, WAF signature, or config flag that removes it. Because the exploit is purely local (a crafted application running on the device), the only meaningful interim mitigations reduce what untrusted code can run:

Confirm the fix landed

After updating, verify the running kernel actually carries the fix. Check the version is 3.5.5 or later (or a vendor build with the backport), and confirm the architecture:

uname -r        # must be 3.5.5+ or a distro/vendor build with commit 8404663
uname -m        # confirms the ARM architecture this CVE applied to

# On Android, confirm the patched firmware build is the one running:
adb shell uname -r

Run an authenticated vulnerability scan with a current signature set and confirm the scanner no longer flags CVE-2013-6282. Because this CVE was abused to root devices and install persistent malware, treat any device that ran unpatched and untrusted code as potentially compromised: a kernel update closes the hole but does not undo a prior root. For high-value units, reflash from a known-good firmware image rather than trusting an in-place patch.

Frequently asked questions

Which kernel version fixes CVE-2013-6282?

Linux kernel 3.5.5 fixes it, via upstream commit 8404663f81d212918ff85f493649a7991209fa04, which adds the missing address check to the ARM get_user and put_user functions. Vendors also backported that commit into older 3.0.x and 3.4.x branches, so a distro or OEM build below 3.5.5 can still be patched if it carries the backport.

Is my x86 server or 64-bit ARM device affected?

No. The missing check was only in the 32-bit ARM (v6k and v7) get_user/put_user implementation. If uname -m reports x86_64 or aarch64, this specific CVE does not apply. It mainly affects older 32-bit ARM Android phones and embedded ARM devices running a pre-3.5.5 kernel.

Is this a remote exploit or does the attacker need to be on the device?

It is local. CVE-2013-6282 gives a crafted application that is already running on the device an arbitrary kernel-memory read/write primitive, which it uses to escalate to root. There is no network attack vector, the high CVSS 8.8 reflects the total system compromise that follows once an unprivileged app gains kernel access.

Is there a public exploit for CVE-2013-6282?

Yes. A working exploit is published on Exploit-DB as entry 40975, and the bug was used in the wild to root Android devices in October and November 2013. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-09-15 because it remained in active use. Patch any exposed pre-3.5.5 ARM device immediately.

References

This guide was assembled from the upstream kernel.org ChangeLog-3.5.5, the fixing commit 8404663f81d2, the Code Aurora security advisory, the NVD record, and the CISA KEV catalog entry. Always confirm against the vendor advisory before applying changes in production.

Other CVEs touching related code paths, worth patching together with this one:

People also ask

Which kernel version fixes CVE-2013-6282?

Linux kernel 3.5.5, via upstream commit 8404663f81d212918ff85f493649a7991209fa04, which adds the missing address check to the ARM get_user and put_user functions. Vendors backported that same commit into older 3.0.x and 3.4.x branches.

Is my x86 server or 64-bit ARM device affected?

No. The flaw is only in the 32-bit ARM (v6k and v7) get_user/put_user code. If uname -m reports x86_64 or aarch64, this CVE does not apply. It mainly hits older 32-bit ARM Android phones and embedded ARM devices on a pre-3.5.5 kernel.

Is this a remote exploit or does the attacker need local access?

It is local. A crafted application already running on the device gains an arbitrary kernel-memory read/write primitive and uses it to escalate to root. There is no network attack vector; the CVSS 8.8 reflects the full compromise that follows.