CVE-2013-2597
Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability
Description
CVE-2013-2597 is a stack-based buffer overflow vulnerability in the Code Aurora ACDB (Audio Calibration Database) audio driver used in third-party products such as Qualcomm chipsets and Android devices. The vulnerability allows a local attacker to escalate privileges through a crafted request to the audio driver. With an EPSS score of 6.74% (91.16th percentile), this vulnerability continues to present risk, particularly to unpatched Android devices. CISA added CVE-2013-2597 to the KEV catalog on September 15, 2022.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| codeaurora | android-msm | 2.6.29; 3.2.54; 3.2.55; 3.2.56; 3.2.57; 3.2.58; 3.2.59; 3.2.60; 3.2.61; 3.2.62; 3.4.72; 3.4.73; 3.4.74; 3.4.75; 3.4.76; 3.4.77; 3.4.78; 3.4.79; 3.4.80; 3.4.81; 3.4.82; 3.4.83; 3.4.84; 3.4.85; 3.4.86; 3.4.87; 3.4.88; 3.4.89; 3.4.90; 3.4.91; 3.4.92; 3.4.93; 3.4.94; 3.4.95; 3.4.96; 3.4.97; 3.4.98; 3.4.99; 3.4.100; 3.4.101; 3.4.102; 3.4.103; 3.10; 3.10.22; 3.10.23; 3.10.24; 3.10.25; 3.10.26; 3.10.27; 3.10.28; 3.10.29; 3.10.30; 3.10.31; 3.10.32; 3.10.33; 3.10.35; 3.10.36; 3.10.37; 3.10.38; 3.10.39; 3.10.40; 3.10.41; 3.10.42; 3.10.43; 3.10.44; 3.10.45; 3.10.46; 3.10.47; 3.10.48; 3.10.49; 3.10.50; 3.10.51; 3.10.52; 3.10.53; 3.12.3; 3.12.4; 3.12.5; 3.12.6; 3.12.7; 3.12.8; 3.12.9; 3.12.10; 3.12.11; 3.12.12; 3.12.13; 3.12.14; 3.12.15; 3.12.16; 3.12.17; 3.12.18; 3.12.19; 3.12.20; 3.12.21; 3.12.22; 3.12.23; 3.12.24; 3.12.25; 3.12.26; 3.13; 3.13.1; 3.13.2; 3.13.3; 3.13.4; 3.13.5; 3.13.6; 3.13.7; 3.13.8; 3.13.9; 3.13.10; 3.13.11; 3.14; 3.14.1; 3.14.2; 3.14.3; 3.14.4; 3.14.5; 3.14.6; 3.14.7; 3.14.8; 3.14.9; 3.14.10; 3.14.11; 3.14.12; 3.14.13; 3.14.14; 3.14.15; 3.14.16; 3.15; 3.15.1; 3.15.2; 3.15.3; 3.15.4; 3.15.5; 3.15.6; 3.15.7; 3.15.8; 3.15.9; 3.15.10; 3.16; 3.16.1; 3.17 |
References
- https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-acdb-audio-driver-cve-2013-2597(Broken Link, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2597(US Government Resource)
Weakness Type
CWE-121: Stack-based Buffer Overflow
CVE-2013-2597 is a stack-based buffer overflow in the Code Aurora ACDB audio driver. The driver fails to properly validate the size of data written to a stack-allocated buffer, allowing a local attacker to overflow the buffer and overwrite adjacent stack memory, including return addresses, to achieve code execution with kernel privileges.
Learn more: CWE-121 — Stack-based Buffer Overflow
Impact Analysis
CVE-2013-2597 is a local privilege escalation vulnerability affecting the audio subsystem of devices using Qualcomm/Code Aurora chipsets, primarily Android smartphones and tablets. The buffer overflow in the ACDB audio driver allows a local application to execute code with kernel-level privileges, completely bypassing all Android security boundaries. Confidentiality, integrity, and availability are critically impacted: kernel-level code execution grants unrestricted access to all device data, the ability to modify any system component, and control over device availability. The EPSS score of 6.74% reflects ongoing exploitation probability, particularly on older Android devices that no longer receive security updates.
Exploit Maturity
CISA added CVE-2013-2597 to the KEV catalog on September 15, 2022, confirming active exploitation of this decade-old vulnerability. The EPSS score of 6.74% (91.16th percentile) indicates elevated exploitation probability. This vulnerability has been widely incorporated into Android rooting tools and mobile malware targeting Qualcomm-based devices. The longevity of this vulnerability in the threat landscape is driven by the large population of Android devices that no longer receive security updates. The ransomware association is classified as unknown.
Remediation
- Update device firmware: Apply kernel and driver updates that address the ACDB audio driver buffer overflow. For Android devices, install the latest available security patches.
- Retire end-of-life devices: Android devices that no longer receive security updates from the manufacturer should be replaced with supported models.
- Restrict app installations: Configure devices to only allow applications from trusted sources and implement enterprise mobile device management policies.
- Deploy mobile threat defense: Use mobile security solutions that can detect kernel exploitation attempts on managed devices.
- Implement network-level protections: Use network access control to limit the access of potentially vulnerable devices to sensitive corporate resources.
Technical Details
CVE-2013-2597 is a stack-based buffer overflow in the Code Aurora ACDB (Audio Calibration Database) audio driver, which is a kernel module present on devices using Qualcomm chipsets. The vulnerability exists because the driver does not properly validate the size of data supplied by userspace applications before copying it to a stack-allocated buffer. When an application sends a specially crafted ioctl request to the ACDB audio driver with data exceeding the buffer capacity, the overflow corrupts adjacent stack memory. An attacker can carefully craft the overflow to overwrite the saved return address on the stack, redirecting kernel execution to attacker-controlled code. Since the audio driver runs in kernel context, successful exploitation grants root-level access to the entire device.
Frequently Asked Questions
Is CVE-2013-2597 being actively exploited?
Yes, CVE-2013-2597 continues to be exploited despite being disclosed in 2013. CISA added it to the KEV catalog in September 2022, and it is widely used in Android rooting tools and mobile malware.
What products are affected by CVE-2013-2597?
CVE-2013-2597 affects the Code Aurora ACDB audio driver used in Qualcomm chipsets, which are present in a large number of Android smartphones and tablets. Any device using affected Qualcomm hardware with unpatched kernel drivers is vulnerable.
How do I fix CVE-2013-2597?
Update the device firmware and kernel to versions that include the ACDB driver fix. Devices no longer receiving security updates should be retired from use.
How severe is CVE-2013-2597?
CVE-2013-2597 is a high-severity privilege escalation vulnerability with an EPSS score of 6.74% (91.16th percentile). The kernel-level buffer overflow enables root access on affected Android devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.