CVE-2013-2094
- State
- Published
- Severity
- 8.4 High
- Published
- May 14, 2013
- Updated
- Oct 22, 2025
- Reserved
- Feb 19, 2013
Description
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.4 High | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- openSUSE-SU-2013:0847vendor-advisory
- MDVSA-2013:176vendor-advisory
- [linux-kernel] 20130413 Re: sw_perf_event_destroy() oops while fuzzingmailing-list
- [linux-kernel] 20130412 sw_perf_event_destroy() oops while fuzzingmailing-list
- [CentOS-announce] 20130517 CESA-2013:0830 Important CentOS 6 kernel Updatemailing-list
- USN-1826-1vendor-advisory
- [linux-kernel] 20130412 Re: sw_perf_event_destroy() oops while fuzzingmailing-list
- USN-1838-1vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=962792
- https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9
- USN-1828-1vendor-advisory
- [CentOS-announce] 20130515 CentOS-6 CVE-2013-2094 Kernel Issuemailing-list
- USN-1827-1vendor-advisory
- USN-1836-1vendor-advisory
- 93361vdb-entry
- 33589exploit
- RHSA-2013:0830vendor-advisory
- http://news.ycombinator.com/item?id=5703758
- [oss-security] 20130514 Re: CVE Request: linux kernel perf out-of-bounds accessmailing-list
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8176cced706b5e5d15887584150764894e94e02f
- SUSE-SU-2013:0819vendor-advisory
- http://packetstormsecurity.com/files/121616/semtex.c
- openSUSE-SU-2013:0925vendor-advisory
- http://twitter.com/djrbliss/statuses/334301992648331267
- http://www.reddit.com/r/netsec/comments/1eb9iw
- openSUSE-SU-2013:1042vendor-advisory
- USN-1825-1vendor-advisory
- openSUSE-SU-2013:0951vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2094government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.