{"id":"CVE-2013-2597","kind":"vulnerability","aliases":["CVE-2013-2597"],"related":[],"title":"codeaurora android-msm: Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel…","description":"Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that leverages /dev/msm_acdb access and provides a large size value in an ioctl argument.","summary":"A stack-based buffer overflow in the Code Aurora ACDB audio calibration driver lets a local process overwrite its stack. An attacker who can run code on the device can escalate privileges, and CISA lists it as actively exploited.","severity":"high","cvss":8.4,"epss":0.01503,"exploited":true,"exploited_at":"2022-09-15T00:00:00+00:00","products":[{"name":"Code Aurora ACDB Audio Driver","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 2.6.29","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.2.54","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.2.55","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.2.56","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.2.57","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.2.58","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.2.59","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.2.60","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.2.61","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.2.62","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.72","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.73","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.74","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.75","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.76","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.77","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.78","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.79","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.80","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.81","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.82","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.83","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.84","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.85","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.86","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.87","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.88","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.89","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.90","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.91","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.92","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.93","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.94","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.95","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.96","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.97","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.98","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.99","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.100","ecosystem":"vendor"},{"name":"codeaurora android-msm","fixed":[],"affected":"= 3.4.101","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["android","embedded-devices","exploited","infrastructure","qualcomm"],"not_affected_if":["no-acdb-driver-present","unpatched-vendor-build-not-in-use"],"how_to_check":"Check the Android or device firmware build date and the Qualcomm security bulletin for the device model; compare against the bulletin that lists the ACDB audio driver fix. unknown for exact commands.","fix":"Apply the vendor firmware or Android security update that includes the ACDB audio driver patch, per CISA's required action.","status":"open","published_at":"2014-08-31T10:55:03+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:10:39+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:10:39Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor firmware or Android security update that includes the ACDB audio driver patch, per CISA's required action.","reach":"local","impact":"high","summary":"A stack-based buffer overflow in the Code Aurora ACDB audio calibration driver lets a local process overwrite its stack. An attacker who can run code on the device can escalate privileges, and CISA lists it as actively exploited.","category":"infrastructure","who_cares":["android","qualcomm","embedded-devices"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local attacker gains elevated privileges on the affected device.","analyst_note":"Find the vendor advisory or Qualcomm bulletin listing affected chipsets and the patched firmware versions; the sources give no version data.","how_to_check":"Check the Android or device firmware build date and the Qualcomm security bulletin for the device model; compare against the bulletin that lists the ACDB audio driver fix. unknown for exact commands.","needs_analyst":true,"not_affected_if":["no-acdb-driver-present","unpatched-vendor-build-not-in-use"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0005,"input_tokens":2883,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2013':28A,31A '-2597':29A,32A '/dev/msm_acdb':297C '2.6':267C '3':270C 'access':298C 'acdb':12A,20A,35A,215B,252C,260C 'acdb.c':17A,257C 'activ':243B 'allow':287C 'android':3A,40A,44A,48A,52A,56A,60A,64A,68A,72A,76A,80A,84A,88A,92A,96A,100A,104A,108A,112A,116A,120A,124A,128A,132A,136A,140A,144A,148A,152A,156A,160A,164A,168A,172A,176A,180A,184A,188A,192A,196A,198B,279C 'android-msm':2A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,83A,87A,91A,95A,99A,103A,107A,111A,115A,119A,123A,127A,131A,135A,139A,143A,147A,151A,155A,159A,163A,167A,171A,175A,179A,183A,187A,191A,195A 'applic':294C 'argument':308C 'attack':227B,288C 'audio':16A,21A,36A,216B,256C,261C 'aurora':34A,214B 'base':7A,208B,247C 'buffer':8A,209B,248C 'calibr':217B 'center':277C 'cisa':239B 'code':33A,213B,231B 'codeaurora':1A,38A,42A,46A,50A,54A,58A,62A,66A,70A,74A,78A,82A,86A,90A,94A,98A,102A,106A,110A,114A,118A,122A,126A,130A,134A,138A,142A,146A,150A,154A,158A,162A,166A,170A,174A,178A,182A,186A,190A,194A 'contribut':280C 'cve':27A,30A 'devic':201B,234B,283C 'driver':22A,37A,218B,262C 'embed':200B 'embedded-devic':199B 'escal':236B 'exploit':202B,244B 'function':14A,254C 'gain':290C 'infrastructur':203B 'innov':276C 'ioctl':13A,253C,307C 'kernel':26A,266C 'larg':302C 'let':219B 'leverag':296C 'linux':25A,265C 'list':240B 'local':221B 'msm':4A,41A,45A,49A,53A,57A,61A,65A,69A,73A,77A,81A,85A,89A,93A,97A,101A,105A,109A,113A,117A,121A,125A,129A,133A,137A,141A,145A,149A,153A,157A,161A,165A,169A,173A,177A,181A,185A,189A,193A,197A,282C 'overflow':9A,210B,249C 'overwrit':223B 'privileg':237B,291C 'process':222B 'product':286C 'provid':300C 'qualcomm':204B,275C 'quic':278C 'run':230B 'size':303C 'stack':6A,207B,225B,246C 'stack-bas':5A,206B,245C 'use':273C 'valu':304C 'via':292C 'x':268C,271C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-08-31T10:55:03+00:00","kev":{"dateAdded":"2022-09-15","dueDate":"2022-10-06","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-2597","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-2597","severity":null,"published_at":"2022-09-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:06+00:00","note":null},{"source":"epss","external_id":"CVE-2013-2597","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-2597","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-2597","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2597","severity":null,"published_at":"2014-08-31T10:55:03+00:00","modified_at":"2026-06-16T23:53:41+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}