{"id":"CVE-2013-2094","kind":"vulnerability","aliases":["CVE-2013-2094"],"related":[],"title":"The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer…","description":"Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.\n\nCISA required action: Apply updates per vendor instructions.","summary":"The Linux kernel does not check all 64 bits of the attr.config value passed from user space to perf events, causing an out-of-bounds array access in sw_perf_event_destroy(). A local user can exploit this to gain root privileges.","severity":"high","cvss":8.4,"epss":0.47709,"exploited":true,"exploited_at":"2022-09-15T00:00:00+00:00","products":[{"name":"linux kernel","fixed":["3.0.75"],"affected":"< 3.0.75","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.2.45"],"affected":">= 3.1, < 3.2.45","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.4.42"],"affected":">= 3.3, < 3.4.42","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.8.9"],"affected":">= 3.5, < 3.8.9","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","self-hosted"],"not_affected_if":["patched-kernel"],"how_to_check":"uname -r to see the running kernel version and compare it against the fixed kernel release for CVE-2013-2094 in your distribution's advisory.","fix":"Install the kernel update from your Linux distribution's vendor and reboot; CISA says to apply updates per vendor instructions.","status":"open","published_at":"2013-05-14T20:55:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:37+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:10:37Z","model":"claude-haiku-5-5","output":{"fix":"Install the kernel update from your Linux distribution's vendor and reboot; CISA says to apply updates per vendor instructions.\nunknown","reach":"local","impact":"high","summary":"The Linux kernel does not check all 64 bits of the attr.config value passed from user space to perf events, causing an out-of-bounds array access in sw_perf_event_destroy(). A local user can exploit this to gain root privileges.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains root privileges on the machine","analyst_note":"Confirm affected kernel version ranges and distro fix versions from the vendor advisories; sources only give KEV and EPSS data.","how_to_check":"uname -r to see the running kernel version and compare it against the fixed kernel release for CVE-2013-2094 in your distribution's advisory.\nunknown","needs_analyst":true,"not_affected_if":["patched-kernel"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00048,"input_tokens":2855,"output_tokens":388,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2013':19A,22A '-2094':20A,23A '3.8.9':13A '64':48B,90C 'access':68B,104C 'action':123C 'allow':117C 'appli':124C 'array':67B,110C 'attr.config':52B,93C 'bit':49B,91C 'bound':66B,103C 'caus':61B 'check':46B,88C 'cisa':121C 'cve':18A,21A 'destroy':73B,115C 'enabl':109C 'escal':120C 'event':60B,72B,114C 'exploit':34B,78B 'explot':116C 'fail':86C 'function':5A 'gain':81B 'host':40B 'incorrect':16A 'infrastructur':35B 'init':4A 'instruct':128C 'integ':17A 'kernel':11A,25A,27A,29A,31A,33A,43B,85C 'kernel/events/core.c':7A 'kubernet':36B 'linux':10A,24A,26A,28A,30A,32A,37B,42B,84C 'local':75B 'out-of-bound':63B,100C 'pass':54B,94C 'per':126C 'perf':2A,59B,71B,107C,113C 'privileg':83B,119C 'requir':122C 'result':98C 'root':82B 'self':39B 'self-host':38B 'space':57B,97C 'sw':70B,112C 'swevent':3A,108C 'updat':125C 'use':14A 'user':56B,76B,96C 'valu':53B 'vendor':127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-05-14T20:55:01+00:00","kev":{"dateAdded":"2022-09-15","dueDate":"2022-10-06","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-2094","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-2094","severity":null,"published_at":"2022-09-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2013-2094","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2094","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-2094","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2094","severity":null,"published_at":"2013-05-14T20:55:01+00:00","modified_at":"2026-06-16T23:52:44+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}