CVE-2013-2596 Linux Kernel Integer Overflow
Local attackers can exploit an integer overflow in the Linux kernel framebuffer driver to map kernel memory and gain elevated privileges.
- Exploited in the wild
- Since 15 Sep 2022
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2596?
CVE-2013-2596 is a high-severity vulnerability in Linux kernel, published on 13 Apr 2013. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
Weakness: CWE-190
Which versions are affected by CVE-2013-2596?
It affects 2 products.
Products include Linux kernel, Motorola Android.
How do I fix CVE-2013-2596?
Apply the vendor's patch. US federal agencies must fix it by 6 Oct 2022.
Is CVE-2013-2596 being exploited?
Yes. Attackers have exploited CVE-2013-2596 in the wild since at least 15 Sep 2022.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2013-2596, GHSA-xg37-4cgv-wc3c, UBUNTU-CVE-2013-2596.