CVE-2013-2094 is a vulnerability in Linux Kernel
Published on May 14, 2013

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

NVD

Known Exploited Vulnerability

This Linux Kernel Privilege Escalation Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.

The following remediation steps are recommended / required by October 6, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

Numeric Errors

Weaknesses in this category are related to improper calculation or conversion of numbers.

Products Associated with CVE-2013-2094

You can be notified by stack.watch whenever vulnerabilities like CVE-2013-2094 are published in these products:

Linux Kernel

What versions of Linux Kernel are vulnerable to CVE-2013-2094?