CVE-2013-2094

HIGH(8.4)KEVElevated Risk

Linux Kernel Privilege Escalation Vulnerability

Description

CVE-2013-2094 is a privilege escalation vulnerability in the Linux kernel caused by a failure to check all 64 bits of the attr.config value passed from user space, resulting in out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). This allows a local unprivileged user to gain root access. With an EPSS score of 59.35% (98.21st percentile), this Linux kernel vulnerability remains highly exploitable. CISA added CVE-2013-2094 to the KEV catalog on September 15, 2022.

KEV Information

Vendor
Linux
Product
Kernel
Date Added
September 15, 2022
Due Date
October 6, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.5
Impact Score
5.9

CWEs

CWE-189

Affected Products

VendorProductVersion
linuxlinux kernel< 3.0.75; >= 3.1, < 3.2.45; >= 3.3, < 3.4.42; >= 3.5, < 3.8.9

References

Weakness Type

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2013-2094 exploits an out-of-bounds array access in the Linux kernel's performance monitoring subsystem. The kernel fails to validate all 64 bits of user-supplied input before using it as an array index, allowing access to memory locations outside the intended array boundaries.

Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Impact Analysis

CVE-2013-2094 is a critical local privilege escalation vulnerability in the Linux kernel's perf subsystem that allows any local user to gain root access with low complexity. The out-of-bounds array access provides a reliable write primitive that can be used to overwrite kernel data structures. Confidentiality, integrity, and availability are all critically impacted as root access grants complete control over the system. The EPSS score of 59.35% reflects the high reliability and widespread availability of exploits for this vulnerability, making it one of the most commonly used Linux kernel privilege escalation flaws.

Exploit Maturity

CISA added CVE-2013-2094 to the KEV catalog on September 15, 2022, confirming continued active exploitation. The EPSS score of 59.35% (98.21st percentile) indicates very high exploitation probability. Reliable public exploits are widely available and have been incorporated into penetration testing frameworks and malware. The vulnerability's simplicity and reliability make it a preferred choice for privilege escalation on vulnerable Linux systems. The ransomware association is classified as unknown.

Remediation

  1. Update the Linux kernel: Apply the patch (commit 8176cced706b) that adds proper 64-bit validation of the attr.config parameter in the perf subsystem.
  2. Restrict perf access: Set kernel.perf_event_paranoid=2 or higher to restrict perf subsystem access to root only on systems where performance monitoring is not needed by unprivileged users.
  3. Retire affected systems: Replace systems running end-of-life kernel versions that cannot be updated.
  4. Monitor for exploitation: Watch for unusual perf_event_open system calls and unexpected privilege escalation activity.
  5. Implement mandatory access controls: Use SELinux or AppArmor to restrict which processes can access the perf subsystem.

Technical Details

CVE-2013-2094 targets the Linux kernel's performance event subsystem (perf). The vulnerability exists in the sw_perf_event_destroy() function, which accesses the perf_swevent_enabled array using an index derived from user-supplied attr.config data. The kernel fails to validate all 64 bits of this value, only checking the lower 32 bits. On 64-bit systems, an attacker can supply a carefully crafted 64-bit value where the lower 32 bits pass the validation check but the full 64-bit value produces an out-of-bounds array index. This out-of-bounds access provides a write-what-where primitive: the attacker can decrement an arbitrary kernel memory location. By targeting specific kernel function pointers or data structures, the attacker can redirect kernel execution to user-controlled code and gain root privileges.

Frequently Asked Questions

Is CVE-2013-2094 being actively exploited?

Yes, CVE-2013-2094 continues to be exploited. CISA added it to the KEV catalog in September 2022. The EPSS score of 59.35% confirms very high exploitation probability with widely available public exploits.

What products are affected by CVE-2013-2094?

CVE-2013-2094 affects the Linux kernel on 64-bit systems with the perf subsystem enabled, which includes most Linux distributions.

How do I fix CVE-2013-2094?

Update the Linux kernel and restrict perf access by setting kernel.perf_event_paranoid=2 on systems where unprivileged performance monitoring is not required.

How severe is CVE-2013-2094?

CVE-2013-2094 has an EPSS score of 59.35% (98.21st percentile). It provides reliable local root privilege escalation through an out-of-bounds kernel memory access.

CVSS Score

8.4
HIGH(8.4)

EPSS Score

EPSS Score47.71%
EPSS Percentile98.8%

Dates

PublishedMay 14, 2013
Last ModifiedJune 16, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch