CVE-2013-2596
Linux Kernel Integer Overflow Vulnerability
Description
CVE-2013-2596 is an integer overflow vulnerability in the Linux kernel's fb_mmap function within drivers/video/fbmem.c that allows local privilege escalation. The flaw enables a local attacker to exploit an integer overflow condition in the framebuffer memory mapping functionality to gain elevated privileges. With an EPSS score of 2.70% (85.67th percentile), this vulnerability remains a relevant threat, particularly on unpatched embedded and mobile Linux devices. CISA added CVE-2013-2596 to the KEV catalog on September 15, 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | >= 2.6.12, < 3.0.75; >= 3.1, < 3.2.45; >= 3.3, < 3.4.42; >= 3.5, < 3.8.9 |
| motorola | android | 4.1.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://forum.xda-developers.com/showthread.php?t=2255491(Exploit)
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b4cbb197c7e7a68dbad0d491242e3ca67420c13e(Broken Link)
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fc9bbca8f650e5f738af8806317c0a041a48ae4a(Broken Link)
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761(Third Party Advisory)
- http://marc.info/?l=linux-kernel&m=136616837923938&w=2(Mailing List, Patch, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-0695.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-0782.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-0803.html(Third Party Advisory)
- http://www.droid-life.com/2013/04/09/root-method-released-for-droid-razr-hd-running-android-4-1-2-other-devices-too/(Exploit, Issue Tracking, Third Party Advisory)
- http://www.droidrzr.com/index.php/topic/15208-root-motochopper-yet-another-android-root-exploit/(Exploit, Issue Tracking)
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9(Mailing List, Release Notes)
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176(Broken Link)
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html(Patch, Third Party Advisory)
- http://www.securityfocus.com/bid/59264(Broken Link, Third Party Advisory, VDB Entry)
- https://github.com/torvalds/linux/commit/b4cbb197c7e7a68dbad0d491242e3ca67420c13e(Patch)
- https://github.com/torvalds/linux/commit/fc9bbca8f650e5f738af8806317c0a041a48ae4a(Exploit, Patch)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2596(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
CVE-2013-2596 exploits an integer overflow in the Linux kernel's framebuffer subsystem. The fb_mmap function in fbmem.c does not properly validate size calculations, allowing a carefully crafted mmap request to trigger an integer overflow that bypasses security checks and enables memory mapping beyond intended boundaries.
Learn more: CWE-190 — Integer Overflow or Wraparound
Impact Analysis
CVE-2013-2596 allows local privilege escalation through the Linux kernel's framebuffer device driver, affecting systems that expose the framebuffer interface. The integer overflow in the fb_mmap function can be exploited to map kernel memory into user space, providing a local attacker with the ability to read and modify kernel data structures. Confidentiality and integrity are highly impacted through direct kernel memory access, while availability can be compromised through kernel corruption. The vulnerability particularly affects Android devices and embedded Linux systems using Qualcomm and other ARM-based processors with framebuffer drivers.
Exploit Maturity
CISA added CVE-2013-2596 to the KEV catalog on September 15, 2022, confirming active exploitation of this decade-old vulnerability. The EPSS score of 2.70% (85.67th percentile) indicates moderate but ongoing exploitation probability. The vulnerability has been used in Android device rooting tools and mobile exploitation frameworks. The ransomware association is classified as unknown.
Remediation
- Update the Linux kernel: Apply the kernel patch (commit fc9bbca8f650) that corrects the integer overflow in the fb_mmap function.
- Update Android devices: Ensure all Android devices receive the latest security patches that address this kernel vulnerability.
- Retire unsupported devices: Replace devices that no longer receive security updates.
- Restrict framebuffer access: On systems where the framebuffer device is not needed, restrict access to /dev/fb* through device permissions or SELinux policies.
- Deploy mobile threat defense: Use mobile security solutions to detect exploitation attempts on managed devices.
Technical Details
CVE-2013-2596 targets the fb_mmap function in the Linux kernel's framebuffer subsystem (drivers/video/fbmem.c). The vulnerability is an integer overflow that occurs during size calculations when mapping framebuffer memory to user space. When a user application requests a memory mapping of the framebuffer device through the mmap system call, the fb_mmap function computes the size and offset of the mapping. Due to insufficient validation, a specially crafted offset or size parameter can cause an integer overflow in these calculations, resulting in a mapping that extends beyond the intended framebuffer region into kernel memory. This provides the attacker with direct read/write access to kernel memory from user space, enabling privilege escalation to root.
Frequently Asked Questions
Is CVE-2013-2596 being actively exploited?
Yes, CVE-2013-2596 continues to be exploited. CISA added it to the KEV catalog in September 2022, and it is used in various Android exploitation tools.
What products are affected by CVE-2013-2596?
CVE-2013-2596 affects the Linux kernel's framebuffer subsystem on systems exposing /dev/fb* devices, primarily Android devices and embedded Linux systems with ARM processors.
How do I fix CVE-2013-2596?
Update the Linux kernel to include the fb_mmap integer overflow fix. For Android devices, apply the latest security updates.
How severe is CVE-2013-2596?
CVE-2013-2596 has an EPSS score of 2.70% (85.67th percentile). The integer overflow enables local privilege escalation through kernel memory access on affected Linux and Android systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.