7.8Hoch KEV

CVE-2013-2596Linux Kernel Integer Overflow Vulnerability

linux linux kernel; motorola android Veröffentlicht: 2013-04-13 04:00 (vor 13 Jahren)

Bekannt ausgenutzt — Linux Kernel Integer Overflow Vulnerability

CISA hat am 15.09.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 06.10.2022.

Erforderliche Maßnahme: Apply updates per vendor instructions. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fc9bbca8f650e5f738af8806317c0a041a48ae4a; https://nvd.nist.gov/vuln/detail/CVE-2013-2596

Beschreibung

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.

Schwachstellentyp (CWE): CWE-190

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
linux	linux kernel	2.6.12 – < 3.0.75
motorola	android	4.1.2

Referenzen und Patches

RHSA-2015:0695 vendor-advisoryThird Party Advisory
59264 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
http://www.droid-life.com/2013/04/09/root-method-released-for-droid-razr-hd-running-android-4-1-2-other-devic… ExploitIssue TrackingThird Party Advisory
MDVSA-2013:176 vendor-advisoryBroken Link
[linux-kernel] 20130417 Device driver memory 'mmap()' function helper cleanup mailing-listMailing ListPatchThird Party Advisory
https://github.com/torvalds/linux/commit/b4cbb197c7e7a68dbad0d491242e3ca67420c13e Patch
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html PatchThird Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b4cbb197c7e7a68dbad0d491242e3… Broken Link
RHSA-2015:0803 vendor-advisoryThird Party Advisory
http://forum.xda-developers.com/showthread.php?t=2255491 Exploit
http://www.droidrzr.com/index.php/topic/15208-root-motochopper-yet-another-android-root-exploit/ ExploitIssue Tracking
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9 Mailing ListRelease Notes
RHSA-2015:0782 vendor-advisoryThird Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 Third Party Advisory
https://github.com/torvalds/linux/commit/fc9bbca8f650e5f738af8806317c0a041a48ae4a ExploitPatch
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fc9bbca8f650e5f738af8806317c0… Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2596 US Government Resource

CPE-Treffer (NVD) (5)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 2.6.12 < 3.0.75
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.1 < 3.2.45
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.3 < 3.4.42
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.5 < 3.8.9
cpe:2.3:o:motorola:android:4.1.2:*:*:*:*:*:*:*

CVSS-Score

7.8Hoch

Quelle: CISA-ADP · CVSS 3.1

Angriffsvektor: Lokal
Komplexität: Niedrig
Rechte erforderlich: Niedrig
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Alle Scores (4)

CISA-ADP	CVSS 3.1	7.8Hoch
nvd	CVSS 3.1	7.8Hoch
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8Hoch
nvd	CVSS 2.0	6.9Mittel

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

3.21%

höher als 88 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: active
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2013-03-15
Veröffentlicht2013-04-13 04:00
Bei IP-DB eingegangen2026-10-24 23:32
In KEV aufgenommen2022-09-15
Zuletzt aktualisiert2026-06-17 02:53

Vergeben von (CNA): mitre
NVD-Status: Analyzed

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Linux kernel

8.1Hoch

CVE-2026-99270 vor 10 Stunden

tcp: Fix potential UAF in reqsk_timer_handler().

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk i…

7.8Hoch

CVE-2026-99269 vor 11 Stunden

sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't clea…

Ohne Score

CVE-2026-99266 vor 11 Stunden

io_uring/zcrx: fix buffer offsets in areas above 4GB

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix buffer offsets in areas above 4GB io_zcrx_queue_cqe() computes the offset of the buffer in its area from net_iov_idx(), which is an unsigned int, so the shift is done in …

Ohne Score

CVE-2026-99267 vor 11 Stunden

io_uring/napi: make stale entries time out after 60s

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: io_uring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout…

Ohne Score

CVE-2026-99268 vor 11 Stunden

io_uring: wake ring pollers for local task_work

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: io_uring: wake ring pollers for local task_work With IORING_SETUP_DEFER_TASKRUN completions are queued as local work, and only become CQEs when the submitter enters the kernel to wait for e…

7.8Hoch

CVE-2026-99264 vor 11 Stunden

io_uring/net: don't retry recv on uncommitted buffers

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b ("io_uring/net: commit partial buffers on retry") commits ring provided buffers when a receive is going to be retri…