8.4High KEV

CVE-2013-2094Linux Kernel Privilege Escalation Vulnerability

linux linux kernel Published: 2013-05-14 23:00 (13 years ago)

Known exploited — Linux Kernel Privilege Escalation Vulnerability

CISA confirmed this vulnerability is used in real attacks on 15.09.2022. Remediation deadline for US federal agencies: 06.10.2022.

Required action: Apply updates per vendor instructions. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8176cced706b5e5d15887584150764894e94e02f; https://nvd.nist.gov/vuln/detail/CVE-2013-2094

Description

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

Weakness (CWE): CWE-189

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
linux	linux kernel	< 3.0.75

References and patches

openSUSE-SU-2013:0847 vendor-advisoryThird Party AdvisoryVDB Entry
MDVSA-2013:176 vendor-advisoryMailing ListThird Party Advisory
[linux-kernel] 20130413 Re: sw_perf_event_destroy() oops while fuzzing mailing-listThird Party Advisory
[linux-kernel] 20130412 sw_perf_event_destroy() oops while fuzzing mailing-listThird Party AdvisoryVDB Entry
[CentOS-announce] 20130517 CESA-2013:0830 Important CentOS 6 kernel Update mailing-listThird Party AdvisoryVDB Entry
USN-1826-1 vendor-advisoryThird Party Advisory
[linux-kernel] 20130412 Re: sw_perf_event_destroy() oops while fuzzing mailing-listThird Party AdvisoryVDB Entry
USN-1838-1 vendor-advisoryThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=962792 Issue Tracking
https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9 Not Applicable
USN-1828-1 vendor-advisoryThird Party Advisory
[CentOS-announce] 20130515 CentOS-6 CVE-2013-2094 Kernel Issue mailing-listThird Party AdvisoryVDB Entry
USN-1827-1 vendor-advisoryThird Party Advisory
USN-1836-1 vendor-advisoryThird Party Advisory
93361 vdb-entryBroken Link
33589 exploitThird Party AdvisoryVDB Entry
RHSA-2013:0830 vendor-advisoryThird Party Advisory
http://news.ycombinator.com/item?id=5703758 Third Party Advisory
[oss-security] 20130514 Re: CVE Request: linux kernel perf out-of-bounds access mailing-listMailing ListThird Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8176cced706b5e5d1588758415076… Not Applicable
SUSE-SU-2013:0819 vendor-advisoryThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/121616/semtex.c ExploitThird Party AdvisoryVDB Entry
openSUSE-SU-2013:0925 vendor-advisoryThird Party AdvisoryVDB Entry
http://twitter.com/djrbliss/statuses/334301992648331267 Patch
http://www.reddit.com/r/netsec/comments/1eb9iw Third Party Advisory
openSUSE-SU-2013:1042 vendor-advisoryThird Party AdvisoryVDB Entry
USN-1825-1 vendor-advisoryThird Party Advisory
openSUSE-SU-2013:0951 vendor-advisoryThird Party AdvisoryVDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2094 US Government Resource

CPE matches (NVD) (4)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* < 3.0.75
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.1 < 3.2.45
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.3 < 3.4.42
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.5 < 3.8.9

CVSS score

8.4High

Source: CISA-ADP · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All scores (3)

CISA-ADP	CVSS 3.1	8.4High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	8.4High
nvd	CVSS 2.0	7.2High

EPSS (chance of exploitation in 30 days)

47.71%

higher than 99% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2013-02-19
Published2013-05-14 23:00
Reached IP-DB2026-10-24 23:32
Added to KEV2022-09-15
Last updated2026-06-17 02:52

Assigned by (CNA): redhat
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Linux kernel

Unscored

CVE-2026-99241 17 hours ago

ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite() ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding mapping->invalidate_lock, so a concurrent truncate or falloc…

Unscored

CVE-2026-99242 17 hours ago

ntfs: fix race between fallocate and mmap reads

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidate_lock for punch hole, collapse range, and insert range operations. For standard allocation …

7.8High

CVE-2026-99239 17 hours ago

Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup. There …

Unscored

CVE-2026-99240 17 hours ago

mm/damon/core: error damos_commit_quota_goal() for zero target_value

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damos_commit_quota_goal() for zero target_value Patch series "mm/damon: move zero damos quota target_value handling to the core layer". Having zero DAMOS quota target …

7.8High

CVE-2026-99237 17 hours ago

tracing: Hold trace_types_lock when resetting last boot data from readers

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when resetting last boot data from readers update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_rea…

7.8High

CVE-2026-99238 17 hours ago

tracing: Hold trace_types_lock when updating modules in persistent instances

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when updating modules in persistent instances trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent …