NetSight
IP …
high8.4Known exploitedPublic exploit code

CVE-2013-2094

Linux Kernel Privilege Escalation Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-09-15. Federal due date: 2022-10-06.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 3.0.75
from 3.1 before 3.2.45
from 3.3 before 3.4.42
from 3.5 before 3.8.9

Weakness classification

CWE-189

References