CVE-2013-4345

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-10-10 · updated 2026-06-16
Weakness: CWE-189

Description

Off-by-one error in the get_prng_bytes function in crypto/ansi_cprng.c in the Linux kernel through 3.11.4 makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via multiple requests for small amounts of data, leading to improper management of the state of the consumed data.

Affected products

Fedoraproject Fedora: 18, 19
Linux kernel: through 3.11.4; 3.0-rc1, 3.0-rc2, 3.0-rc3, 3.0-rc4, 3.0-rc5, 3.0-rc6 (+256)
Red Hat Enterprise Linux: 5, 6.0
RedHat Enterprise Mrg: 2.0, 2.1, 2.2, 2.3, 2.4

References

http://marc.info/?l=linux-crypto-vger&m=137942122902845&w=2
http://rhn.redhat.com/errata/RHSA-2013-1449.html
http://rhn.redhat.com/errata/RHSA-2013-1490.html
http://rhn.redhat.com/errata/RHSA-2013-1645.html
http://www.securityfocus.com/bid/62740
http://www.ubuntu.com/usn/USN-2064-1
http://www.ubuntu.com/usn/USN-2065-1
http://www.ubuntu.com/usn/USN-2068-1
http://www.ubuntu.com/usn/USN-2070-1
http://www.ubuntu.com/usn/USN-2071-1
http://www.ubuntu.com/usn/USN-2072-1
http://www.ubuntu.com/usn/USN-2074-1

Get alerted when CVE-2013-4345 or the next vulnerability affects your stack