CVE-2013-2234

CVE-2013-2234 describes an information disclosure vulnerability in the Linux kernel, specifically affecting versions prior to 3.10. The flaw resides in the key_notify_sa_flush and key_notify_policy_flush functions, which fail to properly initialize structure members. This allows local attackers to extract sensitive information from kernel heap memory by reading broadcast messages from an IPSec key_socket. The vulnerability has a low severity CVSS score of 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N), indicating a local attack vector with low complexity, resulting in partial confidentiality impact without affecting integrity or availability. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public attention.