Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain pri…

published 2013-06-07 13y ago modified 2026-06-16 4mo ago also EUVD-2013-2790

cvss: 6.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits: 0; none known

Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name.

Patch / fix

distros 2

debian red hat

linux Debian 14, Debian 13, Debian 12 3.9.8-1

debian advisories DEBIAN-CVE-2013-2851

kernel RHEL 6 2.6.32-431.el6
perf RHEL 6 2.6.32-431.el6
python-perf RHEL 6 2.6.32-431.el6
kernel-kdump RHEL 6 2.6.32-431.el6
kernel-firmware RHEL 6 2.6.32-431.el6
kernel-bootwrapper RHEL 6 2.6.32-431.el6
kernel-abi-whitelists RHEL 6 2.6.32-431.el6
kernel-debuginfo-common-i686 RHEL 6 2.6.32-431.el6

red hat advisories RHSA-2014:0284 RHSA-2013:1645 RHSA-2013:1783 RHSA-2013:1264

Is CVE-2013-2851 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-2851 updated 2026-11-07 cvss 6.0

kernel: block: passing disk names as format strings

Red Hat Enterprise Linux Compute Node EUS (v. 6.3) perf 2.6.32-279.39.1.el6, kernel 2.6.32-279.39.1.el6, kernel-firmware 2.6.32-279.39.1.el6, kernel-debuginfo-common-x86_64 2.6.32-279.39.1.el6 Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.3) kernel 2.6.32-279.39.1.el6, python-perf 2.6.32-279.39.1.el6, kernel-debuginfo-common-x86_64 2.6.32-279.39.1.el6
fixed: vendor fix RHSA-2013:1783
Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) kernel 2.6.32-358.37.1.el6, python-perf 2.6.32-358.37.1.el6, kernel-debuginfo-common-x86_64 2.6.32-358.37.1.el6
fixed: vendor fix RHSA-2014:0284
Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-431.el6, kernel 2.6.32-431.el6, kernel-firmware 2.6.32-431.el6, kernel-abi-whitelists 2.6.32-431.el6, kernel-debuginfo-common-i686 2.6.32-431.el6, kernel-debuginfo-common-x86_64 2.6.32-431.el6 Red Hat Enterprise Linux Desktop Optional (v. 6) python-perf 2.6.32-431.el6, kernel-debuginfo-common-i686 2.6.32-431.el6, kernel-debuginfo-common-x86_64 2.6.32-431.el6
fixed: vendor fix RHSA-2013:1645
Red Hat Enterprise Linux HPC Node EUS (v. 6.4) perf 2.6.32-358.37.1.el6, kernel 2.6.32-358.37.1.el6, kernel-firmware 2.6.32-358.37.1.el6, kernel-debuginfo-common-x86_64 2.6.32-358.37.1.el6
fixed: vendor fix RHSA-2014:0284
Red Hat Enterprise Linux HPC Node Optional (v. 6) python-perf 2.6.32-431.el6, kernel-debuginfo-common-x86_64 2.6.32-431.el6 Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-431.el6, kernel 2.6.32-431.el6, kernel-kdump 2.6.32-431.el6, kernel-firmware 2.6.32-431.el6, kernel-bootwrapper 2.6.32-431.el6, kernel-abi-whitelists 2.6.32-431.el6, +4 more
fixed: vendor fix RHSA-2013:1645
Red Hat Enterprise Linux Server EUS (v. 6.3) perf 2.6.32-279.39.1.el6, kernel 2.6.32-279.39.1.el6, kernel-kdump 2.6.32-279.39.1.el6, kernel-firmware 2.6.32-279.39.1.el6, kernel-bootwrapper 2.6.32-279.39.1.el6, kernel-debuginfo-common-i686 2.6.32-279.39.1.el6, +3 more
fixed: vendor fix RHSA-2013:1783
Red Hat Enterprise Linux Server EUS (v. 6.4) perf 2.6.32-358.37.1.el6, kernel 2.6.32-358.37.1.el6, kernel-kdump 2.6.32-358.37.1.el6, kernel-firmware 2.6.32-358.37.1.el6, kernel-bootwrapper 2.6.32-358.37.1.el6, kernel-debuginfo-common-i686 2.6.32-358.37.1.el6, +3 more
fixed: vendor fix RHSA-2014:0284
Red Hat Enterprise Linux Server Optional (v. 6) python-perf 2.6.32-431.el6, kernel-debuginfo-common-i686 2.6.32-431.el6, kernel-debuginfo-common-ppc64 2.6.32-431.el6, kernel-debuginfo-common-s390x 2.6.32-431.el6, kernel-debuginfo-common-x86_64 2.6.32-431.el6
fixed: vendor fix RHSA-2013:1645

show 5 more

Red Hat Enterprise Linux Server Optional EUS (v. 6.3) kernel 2.6.32-279.39.1.el6, python-perf 2.6.32-279.39.1.el6, kernel-debuginfo-common-i686 2.6.32-279.39.1.el6, kernel-debuginfo-common-ppc64 2.6.32-279.39.1.el6, kernel-debuginfo-common-s390x 2.6.32-279.39.1.el6, kernel-debuginfo-common-x86_64 2.6.32-279.39.1.el6
fixed: vendor fix RHSA-2013:1783
Red Hat Enterprise Linux Server Optional EUS (v. 6.4) kernel 2.6.32-358.37.1.el6, python-perf 2.6.32-358.37.1.el6, kernel-debuginfo-common-i686 2.6.32-358.37.1.el6, kernel-debuginfo-common-ppc64 2.6.32-358.37.1.el6, kernel-debuginfo-common-s390x 2.6.32-358.37.1.el6, kernel-debuginfo-common-x86_64 2.6.32-358.37.1.el6
fixed: vendor fix RHSA-2014:0284
Red Hat Enterprise Linux Workstation (v. 6) perf 2.6.32-431.el6, kernel 2.6.32-431.el6, kernel-firmware 2.6.32-431.el6, kernel-abi-whitelists 2.6.32-431.el6, kernel-debuginfo-common-i686 2.6.32-431.el6, kernel-debuginfo-common-x86_64 2.6.32-431.el6 Red Hat Enterprise Linux Workstation Optional (v. 6) python-perf 2.6.32-431.el6, kernel-debuginfo-common-i686 2.6.32-431.el6, kernel-debuginfo-common-x86_64 2.6.32-431.el6
fixed: vendor fix RHSA-2013:1645
Red Hat MRG Realtime for RHEL 6 Server v.2 kernel-rt 3.6.11.5-rt37.55.el6rt, mrg-rt-release 3.6.11.5-rt37.55.el6rt, kernel-rt-trace 3.6.11.5-rt37.55.el6rt, kernel-rt-vanilla 3.6.11.5-rt37.55.el6rt, kernel-rt-firmware 3.6.11.5-rt37.55.el6rt, kernel-rt-debuginfo-common-x86_64 3.6.11.5-rt37.55.el6rt
fixed: vendor fix RHSA-2013:1264
Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 7 perf, kernel, bpftool, python-perf, kernel-kdump, kernel-tools, +3 more Red Hat Enterprise Linux HPC Node EUS (v. 6.4) kernel-headers 2.6.32-358.37.1.el6 Red Hat Enterprise Linux Server EUS (v. 6.4) kernel-headers 2.6.32-358.37.1.el6
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.0	AV:L/AC:H/Au:S/C:C/I:C/A:C

Classification

Weakness

CWE-134 Use of Externally-Controlled Format String

Technology feeds

Linux kernel rss critical rss

References

rhn.redhat.com /errata/RHSA-2013-1783.html
vendor-advisory
ubuntu.com /usn/USN-1913-1
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2013-09/msg00003.html
vendor-advisory
rhn.redhat.com /errata/RHSA-2013-1645.html
vendor-advisory
debian.org /security/2013/dsa-2766
vendor-advisory
lists.opensuse.org /opensuse-updates/2013-12/msg00129.html
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2013-09/msg00004.html
vendor-advisory
rhn.redhat.com /errata/RHSA-2014-0284.html
vendor-advisory
ubuntu.com /usn/USN-1941-1
vendor-advisory
ubuntu.com /usn/USN-1942-1
vendor-advisory
ubuntu.com /usn/USN-1912-1
vendor-advisory
marc.info /?l=linux-kernel&m=137055204522556&w=2
mailing-list
bugzilla.redhat.com /show_bug.cgi?id=969515
openwall.com /lists/oss-security/2013/06/06/13
mailing-list

Sources

CVE List CVE-2013-2851
NVD CVE-2013-2851

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.