CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
14Exploited in Wild
YesDecision
Descriptions
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
La función perf_swevent_init en kernel/events/core.c en el Kernel de Linux anterior a v3.8.9 usa un tipo de datos entero incorrecto, lo que permite a usuarios locales ganar privilegios mediante una llamada al sistema perf_event_open especialmente diseñada.
Security fixes: It was found that the kernel-rt update RHBA-2012:0044 introduced an integer conversion issue in the Linux kernel's Performance Events implementation. This led to a user-supplied index into the perf_swevent_enabled array not being validated properly, resulting in out-of-bounds kernel memory access. A local, unprivileged user could use this flaw to escalate their privileges. A public exploit for CVE-2013-2094 that affects Red Hat Enterprise MRG 2 is available. Refer to Red Hat Knowledge Solution 373743, linked to in the References, for further information and mitigation instructions for users who are unable to immediately apply this update.
Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.
CVSS Scores
SSVC
- Decision:Act
Timeline
- 2013-02-19 CVE Reserved
- 2013-05-14 CVE Published
- 2013-05-14 First Exploit
- 2022-09-15 Exploited in Wild
- 2022-10-06 KEV Due Date
- 2025-05-01 CVE Updated
- 2025-05-09 EPSS Updated
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-189: Numeric Errors
CAPEC
References (42)
| URL | Tag | Source |
|---|---|---|
| http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8176cced706b5e5d15887584150764894e94e02f | Not Applicable | |
| http://lists.centos.org/pipermail/centos-announce/2013-May/019729.html | Mailing List | |
| http://lists.centos.org/pipermail/centos-announce/2013-May/019733.html | Mailing List | |
| http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/03652.html | Mailing List | |
| http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/03976.html | Mailing List | |
| http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/04302.html | Mailing List | |
| http://news.ycombinator.com/item?id=5703758 | Third Party Advisory | |
| http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9 | Not Applicable | |
| http://www.openwall.com/lists/oss-security/2013/05/14/6 | Mailing List |
|
| http://www.osvdb.org/93361 | Broken Link | |
| http://www.reddit.com/r/netsec/comments/1eb9iw | Third Party Advisory | |
| https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/126880 | 2014-06-02 | |
| https://packetstorm.news/files/id/125674 | 2014-03-12 | |
| https://packetstorm.news/files/id/121976 | 2013-06-11 | |
| https://www.exploit-db.com/exploits/25444 | 2013-05-14 | |
| https://www.exploit-db.com/exploits/26131 | 2013-06-11 | |
| https://www.exploit-db.com/exploits/33589 | 2014-05-31 | |
| https://github.com/Pashkela/CVE-2013-2094 | 2013-06-16 | |
| https://github.com/vnik5287/CVE-2013-2094 | 2019-07-23 | |
| https://github.com/realtalk/cve-2013-2094 | 2024-08-12 | |
| https://github.com/hiikezoe/libperf_event_exploit | 2024-08-12 | |
| https://github.com/tarunyadav/fix-cve-2013-2094 | 2017-02-01 | |
| https://github.com/timhsutw/cve-2013-2094 | 2024-08-12 | |
| http://packetstormsecurity.com/files/121616/semtex.c | 2025-05-01 | |
| http://www.exploit-db.com/exploits/33589 | 2025-05-01 |
| URL | Date | SRC |
|---|---|---|
| http://twitter.com/djrbliss/statuses/334301992648331267 | 2024-03-04 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 3.0.75 Search vendor "Linux" for product "Linux Kernel" and version " < 3.0.75" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.1 < 3.2.45 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.1 < 3.2.45" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.3 < 3.4.42 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.3 < 3.4.42" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.5 < 3.8.9 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.5 < 3.8.9" | - |
Affected
| ||||||