VIR Vulnerability Intelligence Relay

CVE-2013-1813

high
Published 2013-11-23 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
7.2

Description

util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
redhat Red Hat Affected 1 release
VersionStatusFixed in
6.0 Affected —
debian Debian Fixed 5 releases
VersionStatusFixed in
trixie Fixed 1:1.20.0-8
sid Fixed 1:1.20.0-8
forky Fixed 1:1.20.0-8
bullseye Fixed 1:1.20.0-8
bookworm Fixed 1:1.20.0-8

Application impact
VendorProductVersionsFixed
busyboxbusybox{"endIncluding":"1.20.2"}
busyboxbusybox0.38
busyboxbusybox0.39
busyboxbusybox0.40
busyboxbusybox0.41
busyboxbusybox0.42
busyboxbusybox0.43
busyboxbusybox0.45
busyboxbusybox0.46
busyboxbusybox0.47
busyboxbusybox0.48
busyboxbusybox0.49
busyboxbusybox0.50
busyboxbusybox0.51
busyboxbusybox0.52
busyboxbusybox0.60.0
busyboxbusybox0.60.1
busyboxbusybox0.60.2
busyboxbusybox0.60.3
busyboxbusybox0.60.4
busyboxbusybox0.60.5
busyboxbusybox1.00
busyboxbusybox1.01
busyboxbusybox1.1.0
busyboxbusybox1.1.1
busyboxbusybox1.1.2
busyboxbusybox1.1.3
busyboxbusybox1.2.0
busyboxbusybox1.2.1
busyboxbusybox1.2.2
busyboxbusybox1.2.2.1
busyboxbusybox1.3.0
busyboxbusybox1.3.1
busyboxbusybox1.3.2
busyboxbusybox1.4.0
busyboxbusybox1.4.1
busyboxbusybox1.4.2
busyboxbusybox1.5.0
busyboxbusybox1.5.1
busyboxbusybox1.6.0
busyboxbusybox1.6.1
busyboxbusybox1.7.0
busyboxbusybox1.7.1
busyboxbusybox1.7.2
busyboxbusybox1.7.3
busyboxbusybox1.8.0
busyboxbusybox1.8.1
busyboxbusybox1.8.2
busyboxbusybox1.9.0
busyboxbusybox1.9.1
busyboxbusybox1.9.2
busyboxbusybox1.10.0
busyboxbusybox1.10.1
busyboxbusybox1.10.2
busyboxbusybox1.10.3
busyboxbusybox1.10.4
busyboxbusybox1.11.0
busyboxbusybox1.11.1
busyboxbusybox1.11.2
busyboxbusybox1.11.3
busyboxbusybox1.12.0
busyboxbusybox1.12.1
busyboxbusybox1.12.2
busyboxbusybox1.12.3
busyboxbusybox1.12.4
busyboxbusybox1.13.0
busyboxbusybox1.13.1
busyboxbusybox1.13.2
busyboxbusybox1.13.3
busyboxbusybox1.13.4
busyboxbusybox1.14.0
busyboxbusybox1.14.1
busyboxbusybox1.14.2
busyboxbusybox1.14.3
busyboxbusybox1.14.4
busyboxbusybox1.15.0
busyboxbusybox1.15.1
busyboxbusybox1.15.2
busyboxbusybox1.15.3
busyboxbusybox1.16.0
busyboxbusybox1.16.1
busyboxbusybox1.16.2
busyboxbusybox1.17.0
busyboxbusybox1.17.1
busyboxbusybox1.17.2
busyboxbusybox1.17.3
busyboxbusybox1.17.4
busyboxbusybox1.18.0
busyboxbusybox1.18.1
busyboxbusybox1.18.2
busyboxbusybox1.18.3
busyboxbusybox1.18.4
busyboxbusybox1.18.5
busyboxbusybox1.19.0
busyboxbusybox1.19.2
busyboxbusybox1.19.3
busyboxbusybox1.19.4
busyboxbusybox1.20.0
busyboxbusybox1.20.1

References

CWEs

CWE-264

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.