CVE-2013-2094 kev in the critical feed json
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows l…
published 13y ago modified 4mo ago also EUVD-2013-2068
- cvss
- 8.4
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-09-15
- epss
- 47.7%
- EPSS 47.7% chance of exploitation in 30 days, percentile 98%
- public exploits
- 3
- Exploit-DB
Summary
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Patch / fix
cisa required action Apply updates per vendor instructions.
- linux linux_kernel 3.0.75, 3.2.45, 3.4.42, 3.8.9
- linux Debian 14, Debian 13, Debian 12 3.8.11-1
debian advisories DEBIAN-CVE-2013-2094
- kernel-rt enterprise mrg 2 3.6.11.2-rt33.39.el6rt
- mrg-rt-release enterprise mrg 2 3.6.11.2-rt33.39.el6rt
- kernel-rt-trace enterprise mrg 2 3.6.11.2-rt33.39.el6rt
- kernel-rt-vanilla enterprise mrg 2 3.6.11.2-rt33.39.el6rt
- kernel-rt-firmware enterprise mrg 2 3.6.11.2-rt33.39.el6rt
- kernel-rt-debuginfo-common-x86_64 enterprise mrg 2 3.6.11.2-rt33.39.el6rt
- kernel RHEL 6 2.6.32-358.6.2.el6
- perf RHEL 6 2.6.32-358.6.2.el6
red hat advisories RHSA-2013:0829RHSA-2013:0841RHSA-2013:0840RHSA-2013:0832RHSA-2013:0830
- kernel CBL-Mariner 2.0 5.15.153.1-1
- kernel Azure Linux 3.0 6.6.22.1-2
azure linux advisories AZL-34322AZL-34846
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Is CVE-2013-2094 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2013-2094 updated cvss 7.2
kernel: perf_swevent_enabled array out-of-bound access
-
Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-358.6.2.el6, kernel 2.6.32-358.6.2.el6, kernel-firmware 2.6.32-358.6.2.el6, kernel-debuginfo-common-i686 2.6.32-358.6.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.6.2.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) kernel 2.6.32-358.6.2.el6, python-perf 2.6.32-358.6.2.el6, kernel-debuginfo-common-i686 2.6.32-358.6.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.6.2.el6 Red Hat Enterprise Linux HPC Node (v. 6) perf 2.6.32-358.6.2.el6, kernel 2.6.32-358.6.2.el6, kernel-firmware 2.6.32-358.6.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.6.2.el6 Red Hat Enterprise Linux HPC Node Optional (v. 6) kernel 2.6.32-358.6.2.el6, python-perf 2.6.32-358.6.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.6.2.el6 Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-358.6.2.el6, kernel 2.6.32-358.6.2.el6, kernel-kdump 2.6.32-358.6.2.el6, kernel-firmware 2.6.32-358.6.2.el6, kernel-bootwrapper 2.6.32-358.6.2.el6, kernel-debuginfo-common-i686 2.6.32-358.6.2.el6, +3 morefixed: vendor fix RHSA-2013:0830
-
Red Hat Enterprise Linux Server EUS (v. 6.1) perf 2.6.32-131.39.1.el6, kernel 2.6.32-131.39.1.el6, kernel-kdump 2.6.32-131.39.1.el6, kernel-firmware 2.6.32-131.39.1.el6, kernel-bootwrapper 2.6.32-131.39.1.el6, kernel-debuginfo-common-i686 2.6.32-131.39.1.el6, +3 morefixed: vendor fix RHSA-2013:0841
-
Red Hat Enterprise Linux Server EUS (v. 6.2) perf 2.6.32-220.34.2.el6, kernel 2.6.32-220.34.2.el6, kernel-kdump 2.6.32-220.34.2.el6, kernel-firmware 2.6.32-220.34.2.el6, kernel-bootwrapper 2.6.32-220.34.2.el6, kernel-debuginfo-common-i686 2.6.32-220.34.2.el6, +3 morefixed: vendor fix RHSA-2013:0840
-
Red Hat Enterprise Linux Server EUS (v. 6.3) perf 2.6.32-279.25.2.el6, kernel 2.6.32-279.25.2.el6, kernel-kdump 2.6.32-279.25.2.el6, kernel-firmware 2.6.32-279.25.2.el6, kernel-bootwrapper 2.6.32-279.25.2.el6, kernel-debuginfo-common-i686 2.6.32-279.25.2.el6, +3 morefixed: vendor fix RHSA-2013:0832
-
Red Hat Enterprise Linux Server Optional (v. 6) kernel 2.6.32-358.6.2.el6, python-perf 2.6.32-358.6.2.el6, kernel-debuginfo-common-i686 2.6.32-358.6.2.el6, kernel-debuginfo-common-ppc64 2.6.32-358.6.2.el6, kernel-debuginfo-common-s390x 2.6.32-358.6.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.6.2.el6fixed: vendor fix RHSA-2013:0830
-
Red Hat Enterprise Linux Server Optional EUS (v. 6.2) kernel 2.6.32-220.34.2.el6, python-perf 2.6.32-220.34.2.el6, kernel-debuginfo-common-i686 2.6.32-220.34.2.el6, kernel-debuginfo-common-ppc64 2.6.32-220.34.2.el6, kernel-debuginfo-common-s390x 2.6.32-220.34.2.el6, kernel-debuginfo-common-x86_64 2.6.32-220.34.2.el6fixed: vendor fix RHSA-2013:0840
-
Red Hat Enterprise Linux Server Optional EUS (v. 6.3) kernel 2.6.32-279.25.2.el6, python-perf 2.6.32-279.25.2.el6, kernel-debuginfo-common-i686 2.6.32-279.25.2.el6, kernel-debuginfo-common-ppc64 2.6.32-279.25.2.el6, kernel-debuginfo-common-s390x 2.6.32-279.25.2.el6, kernel-debuginfo-common-x86_64 2.6.32-279.25.2.el6fixed: vendor fix RHSA-2013:0832
-
Red Hat Enterprise Linux Workstation (v. 6) perf 2.6.32-358.6.2.el6, kernel 2.6.32-358.6.2.el6, kernel-firmware 2.6.32-358.6.2.el6, kernel-debuginfo-common-i686 2.6.32-358.6.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.6.2.el6 Red Hat Enterprise Linux Workstation Optional (v. 6) kernel 2.6.32-358.6.2.el6, python-perf 2.6.32-358.6.2.el6, kernel-debuginfo-common-i686 2.6.32-358.6.2.el6, kernel-debuginfo-common-x86_64 2.6.32-358.6.2.el6fixed: vendor fix RHSA-2013:0830
show 2 moreshow fewer
-
Red Hat MRG Realtime for RHEL 6 Server v.2 kernel-rt 3.6.11.2-rt33.39.el6rt, mrg-rt-release 3.6.11.2-rt33.39.el6rt, kernel-rt-trace 3.6.11.2-rt33.39.el6rt, kernel-rt-vanilla 3.6.11.2-rt33.39.el6rt, kernel-rt-firmware 3.6.11.2-rt33.39.el6rt, kernel-rt-debuginfo-common-x86_64 3.6.11.2-rt33.39.el6rtfixed: vendor fix RHSA-2013:0829
-
Red Hat Enterprise Linux 5 kernelnot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Timeline
- First public exploit (EDB-25444)
- Published
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4y ago
- Patch by
- 2022-10-06 (4y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Linux, Kernel
- CISA name
- Linux Kernel Privilege Escalation Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- last yr.
Exploit prediction
47.71% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-33589 Linux Kernel 3.2.0-23/3.5.0-23 (Ubuntu 12.04/12.04.1/12.04.2 x64) - 'perf_swevent_init' Local Privilege Escalation (3) local, 2014-05-31
- EDB-26131 Linux Kernel < 3.8.9 (x86-64) - 'perf_swevent_init' Local Privilege Escalation (2) local, 2013-06-11
- EDB-25444 Linux Kernel 2.6.32 < 3.x (CentOS 5/6) - 'PERF_EVENTS' Local Privilege Escalation (1) local, 2013-05-14
- packetstormsecurity.com http://packetstormsecurity.com/files/121616/semtex.c referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-189 Numeric Errors
- Technology feeds
References
-
github.com
/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f
third-party-advisory
-
twitter.com
/djrbliss/statuses/334301992648331267
patch
-
exploit-db.com
/exploits/33589
exploit, third-party-advisory, vdb-entry
-
packetstormsecurity.com
/files/121616/semtex.c
exploit, third-party-advisory, vdb-entry
-
lists.opensuse.org
/opensuse-security-announce/2013-05/msg00018.html
vendor-advisory, third-party-advisory, vdb-entry
-
mandriva.com
/security/advisories?name=MDVSA-2013:176
vendor-advisory, mailing-list, third-party-advisory
-
ubuntu.com
/usn/USN-1826-1
vendor-advisory, third-party-advisory
-
ubuntu.com
/usn/USN-1838-1
vendor-advisory, third-party-advisory
-
ubuntu.com
/usn/USN-1828-1
vendor-advisory, third-party-advisory
-
ubuntu.com
/usn/USN-1827-1
vendor-advisory, third-party-advisory
-
ubuntu.com
/usn/USN-1836-1
vendor-advisory, third-party-advisory
-
rhn.redhat.com
/errata/RHSA-2013-0830.html
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2013-05/msg00008.html
vendor-advisory, third-party-advisory, vdb-entry
-
lists.opensuse.org
/opensuse-security-announce/2013-06/msg00005.html
vendor-advisory, third-party-advisory, vdb-entry
-
lists.opensuse.org
/opensuse-security-announce/2013-06/msg00017.html
vendor-advisory, third-party-advisory, vdb-entry
-
ubuntu.com
/usn/USN-1825-1
vendor-advisory, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2013-06/msg00009.html
vendor-advisory, third-party-advisory, vdb-entry
-
lkml.indiana.edu
/hypermail/linux/kernel/1304.1/04302.html
mailing-list, third-party-advisory
-
lkml.indiana.edu
/hypermail/linux/kernel/1304.1/03652.html
mailing-list, third-party-advisory, vdb-entry
-
lists.centos.org
/pipermail/centos-announce/2013-May/019733.html
mailing-list, third-party-advisory, vdb-entry
-
lkml.indiana.edu
/hypermail/linux/kernel/1304.1/03976.html
mailing-list, third-party-advisory, vdb-entry
-
bugzilla.redhat.com
/show_bug.cgi?id=962792
issue-tracking
-
kernel.org
/pub/linux/kernel/v3.x/ChangeLog-3.8.9
not-applicable
-
lists.centos.org
/pipermail/centos-announce/2013-May/019729.html
mailing-list, third-party-advisory, vdb-entry
-
osvdb.org
/93361
vdb-entry, broken-link
-
news.ycombinator.com
/item?id=5703758
third-party-advisory
-
openwall.com
/lists/oss-security/2013/05/14/6
mailing-list, third-party-advisory
-
git.kernel.org
/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8176cced706b5e5d15887584150764894e94e02f
not-applicable
-
reddit.com
/r/netsec/comments/1eb9iw
third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2094
government-resource, us-government-resource
Sources
- CVE List CVE-2013-2094
- NVD CVE-2013-2094
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.