CVE-2013-2094 is a vulnerability in Linux Kernel
Published on May 14, 2013
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Known Exploited Vulnerability
This Linux Kernel Privilege Escalation Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.
The following remediation steps are recommended / required by October 6, 2022: Apply updates per vendor instructions.
Weaknesses in this category are related to improper calculation or conversion of numbers.
Products Associated with CVE-2013-2094
You can be notified by stack.watch whenever vulnerabilities like CVE-2013-2094 are published in these products:
What versions of Linux Kernel are vulnerable to CVE-2013-2094?
- Linux Kernel Version 3.8.2
- Linux Kernel Version 3.8.7
- Linux Kernel Version 3.8.0
- Linux Kernel Version 3.8.6
- Linux Kernel Up to Version 3.8.8
- Linux Kernel Version 3.8.5
- Linux Kernel Version 3.8.1
- Linux Kernel Version 3.8.3
- Linux Kernel Version 3.8.4