{"id":"CVE-2013-2596","kind":"vulnerability","aliases":["CVE-2013-2596"],"related":[],"title":"Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a…","description":"Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.","summary":"The Linux kernel's fb_mmap function in drivers/video/fbmem.c has an integer overflow. A local user can use it to gain root privileges.","severity":"high","cvss":7.8,"epss":0.03212,"exploited":true,"exploited_at":"2022-09-15T00:00:00+00:00","products":[{"name":"linux kernel","fixed":["3.0.75"],"affected":">= 2.6.12, < 3.0.75","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.2.45"],"affected":">= 3.1, < 3.2.45","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.4.42"],"affected":">= 3.3, < 3.4.42","ecosystem":"vendor"},{"name":"linux kernel","fixed":["3.8.9"],"affected":">= 3.5, < 3.8.9","ecosystem":"vendor"},{"name":"motorola android","fixed":[],"affected":"= 4.1.2","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kernel","linux","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Update the Linux kernel to a release that includes the upstream fix for CVE-2013-2596, per your distribution's vendor instructions.","status":"open","published_at":"2013-04-13T02:59:46+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:36+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:10:36Z","model":"claude-haiku-5-5","output":{"fix":"Update the Linux kernel to a release that includes the upstream fix for CVE-2013-2596, per your distribution's vendor instructions.","reach":"local","impact":"high","summary":"The Linux kernel's fb_mmap function in drivers/video/fbmem.c has an integer overflow. A local user can use it to gain root privileges.","category":"infrastructure","who_cares":["linux","self-hosted","kernel"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local user escalates to root and takes over the machine.","analyst_note":"Confirm fixed kernel versions and whether the framebuffer driver (fbdev) must be loaded for exposure, via the NVD or distro advisories for CVE-2013-2596.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000448,"input_tokens":2824,"output_tokens":331,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2013':19A,22A '-2596':20A,23A '/dev/graphics/fb0':117C '3.8.9':15A,80C '4.1.2':90C 'allow':94C 'android':33A,89C 'build':87C 'call':120C 'certain':85C 'consequ':112C 'craft':116C 'creat':98C 'cve':18A,21A 'demonstr':122C 'drivers/video/fbmem.c':9A,51B,74C 'entireti':107C 'exploit':36B 'fb':5A,47B,70C 'function':7A,49B,72C 'gain':63B,113C 'host':42B 'infrastructur':37B 'integ':1A,54B,66C 'kernel':13A,25A,27A,29A,31A,35A,38B,45B,78C,109C 'linux':12A,24A,26A,28A,30A,34A,39B,44B,77C 'local':57B,95C 'map':104C 'memori':103C,110C 'mmap':6A,48B,71C 'mmap2':118C 'motochopp':125C 'motorola':32A,86C 'overflow':2A,55B,67C 'privileg':65B,114C 'product':93C 'program':127C 'pwn':126C 'read':101C 'read-writ':100C 'root':64B 'self':41B 'self-host':40B 'system':119C 'use':17A,60B,82C 'user':58B,96C 'via':115C 'write':102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-04-13T02:59:46+00:00","kev":{"dateAdded":"2022-09-15","dueDate":"2022-10-06","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-2596","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-2596","severity":null,"published_at":"2022-09-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2013-2596","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2596","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-2596","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2596","severity":null,"published_at":"2013-04-13T02:59:46+00:00","modified_at":"2026-06-16T23:53:41+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}