CVEs / CVE-2013-2094
CVE-2013-2094: Linux Kernel Privilege Escalation Vulnerability
- Known exploited in the CISA KEV catalog since 15 Sep 2022
- high 7.2 CVSS 2.0 (NVD)
- EPSS 47.7% chance of exploitation in the next 30 days, higher than 98% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2013-2094
Summary
Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.
Description
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 15 Sep 2022 |
|---|---|
| Due date for US federal agencies | 6 Oct 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | Apply updates per vendor instructions. |
Severity
| CVSS 2.0 | 7.2 highAV:L/AC:L/Au:N/C:C/I:C/A:CScored by NVD |
|---|---|
| Weakness | CWE-189 |
References
- CVE-2013-2094 on NVD
- CVE-2013-2094 in the CISA KEV catalog
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8176cced706b5e5d15887584150764894e94e02f (cited by CISA)
- CVE-2013-2094 on OSV
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8176cced706b5e5d15887584150764894e94e02f Not Applicable
- http://lists.centos.org/pipermail/centos-announce/2013-May/019729.html Third Party Advisory, VDB Entry
- http://lists.centos.org/pipermail/centos-announce/2013-May/019733.html Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00008.html Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00009.html Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00017.html Third Party Advisory, VDB Entry
- http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/03652.html Third Party Advisory, VDB Entry
- http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/03976.html Third Party Advisory, VDB Entry
- http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/04302.html Third Party Advisory
- http://news.ycombinator.com/item?id=5703758 Third Party Advisory
- http://packetstormsecurity.com/files/121616/semtex.c Exploit, Third Party Advisory, VDB Entry
- http://rhn.redhat.com/errata/RHSA-2013-0830.html Third Party Advisory
- http://twitter.com/djrbliss/statuses/334301992648331267 Patch
- http://www.exploit-db.com/exploits/33589 Third Party Advisory, VDB Entry
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9 Not Applicable
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2013/05/14/6 Mailing List, Third Party Advisory
- http://www.osvdb.org/93361 Broken Link
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.