CVE-2013-2094

8.4

CVSS
High

PUBLISHED

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local...

Exploited in the wild Low complexity No user interaction

Vendor: Linux
Product: Linux Kernel
Published: May 14, 2013
EPSS: —

Description

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.

linux cisa nessus_scanner

CVSS scores

CVSS v3.1 8.4 High

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 7.2

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitation status

Exploited in the wild

Recorded 2022-09-15 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: No
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Sep 15, 2022

Scanner integrations

Scanner	Reference	Detected
Nessus	https://www.tenable.com/plugins/nessus/215527	Jun 02, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

vnik5287/CVE-2013-2094

github · Created 2019-07-23 12:31:55 UTC · 1 stars

perf_swevent_init

Pashkela/CVE-2013-2094

github · Created 2013-06-16 11:53:36 UTC · 4 stars

CVE-2013-2094 Linux 2.6.32/2.6.37 - 3.8.10 PERF_EVENTS local root x86/x86_64

Vulnerability detail