The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9…
Priority CRITICAL 96Exploited in the wildCWE-189Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-189 and the CVSS impact.
Summary
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Why it matters now
Exploitation Active In CISA KEV since 2022-09-15CISA due date 2022-10-06
EPSS 0.47709 98th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA and NVD
Fix Fixed Red Hat: 5 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | before 3.0.75; 3.1 to before 3.2.45; 3.3 to before 3.4.42; 3.5 to before 3.8.9 | Vulnerable | Linux |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 3.0.75; 3.1 to before 3.2.45; 3.3 to before 3.4.42; 3.5 to before 3.8.9 Vulnerable ·Linux
Remediation
Red Hat 5 advisories
- RHSA-2013:0829 Released 2013-05-20 · Red Hat rating Importantkernel-rt security and bug fix update
- Red Hat MRG Realtime for RHEL 6 Server v.2 kernel-rt-3.6.11.2-rt33.39.el6rt, kernel-rt-debug-3.6.11.2-rt33.39.el6rt, kernel-rt-debug-devel-3.6.11.2-rt33.39.el6rt +8
- RHSA-2013:0840 Released 2013-05-20 · Red Hat rating Importantkernel security update
- Red Hat Enterprise Linux Server EUS (v. 6.2) kernel-2.6.32-220.34.2.el6, kernel-bootwrapper-2.6.32-220.34.2.el6, kernel-debug-2.6.32-220.34.2.el6 +8
- Red Hat Enterprise Linux Server Optional EUS (v. 6.2) kernel-2.6.32-220.34.2.el6, python-perf-2.6.32-220.34.2.el6
- RHSA-2013:0841 Released 2013-05-20 · Red Hat rating Importantkernel security update
- Red Hat Enterprise Linux Server EUS (v. 6.1) kernel-2.6.32-131.39.1.el6, kernel-bootwrapper-2.6.32-131.39.1.el6, kernel-debug-2.6.32-131.39.1.el6 +8
Show 2 more Red Hat advisories
- RHSA-2013:0832 Released 2013-05-17 · Red Hat rating Importantkernel security update
- Red Hat Enterprise Linux Server EUS (v. 6.3) kernel-2.6.32-279.25.2.el6, kernel-bootwrapper-2.6.32-279.25.2.el6, kernel-debug-2.6.32-279.25.2.el6 +8
- Red Hat Enterprise Linux Server Optional EUS (v. 6.3) kernel-2.6.32-279.25.2.el6, python-perf-2.6.32-279.25.2.el6
- RHSA-2013:0830 Released 2013-05-16 · Red Hat rating Importantkernel security update
- Red Hat Enterprise Linux Desktop (v. 6) kernel-2.6.32-358.6.2.el6, kernel-debug-2.6.32-358.6.2.el6, kernel-debug-devel-2.6.32-358.6.2.el6 +5
- Red Hat Enterprise Linux Desktop Optional (v. 6) kernel-2.6.32-358.6.2.el6, python-perf-2.6.32-358.6.2.el6
- Red Hat Enterprise Linux HPC Node (v. 6) kernel-2.6.32-358.6.2.el6, kernel-debug-2.6.32-358.6.2.el6, kernel-debug-devel-2.6.32-358.6.2.el6 +5
- Red Hat Enterprise Linux HPC Node Optional (v. 6) kernel-2.6.32-358.6.2.el6, python-perf-2.6.32-358.6.2.el6
- Red Hat Enterprise Linux Server (v. 6) kernel-2.6.32-358.6.2.el6, kernel-bootwrapper-2.6.32-358.6.2.el6, kernel-debug-2.6.32-358.6.2.el6 +8
- Red Hat Enterprise Linux Server Optional (v. 6) kernel-2.6.32-358.6.2.el6, python-perf-2.6.32-358.6.2.el6
- Red Hat Enterprise Linux Workstation (v. 6) kernel-2.6.32-358.6.2.el6, kernel-debug-2.6.32-358.6.2.el6, kernel-debug-devel-2.6.32-358.6.2.el6 +5
- Red Hat Enterprise Linux Workstation Optional (v. 6) kernel-2.6.32-358.6.2.el6, python-perf-2.6.32-358.6.2.el6
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2013:0830 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2013:0830 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2013:0830 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2013:0830 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2013:0830 |
| Red Hat Enterprise Linux Server EUS (v. 6.1) | Fixed | RHSA-2013:0841 |
| Red Hat Enterprise Linux Server EUS (v. 6.2) | Fixed | RHSA-2013:0840 |
| Red Hat Enterprise Linux Server EUS (v. 6.3) | Fixed | RHSA-2013:0832 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2013:0830 |
| Red Hat Enterprise Linux Server Optional EUS (v. 6.2) | Fixed | RHSA-2013:0840 |
| Red Hat Enterprise Linux Server Optional EUS (v. 6.3) | Fixed | RHSA-2013:0832 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2013:0830 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2013:0830 |
| Red Hat MRG Realtime for RHEL 6 Server v.2 | Fixed | RHSA-2013:0829 |
Not affected: 1 product
- Red Hat Enterprise Linux 5
Timeline
- 2022-09-15 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2013-2094
- 2026-10-03 Alias added: GHSA-xpgm-72rm-72p4
References
Advisory 22
- openSUSE-SU-2013:0847
- MDVSA-2013:176
- [linux-kernel] 20130413 Re: sw_perf_event_destroy() oops while fuzzing
- [linux-kernel] 20130412 sw_perf_event_destroy() oops while fuzzing
- [CentOS-announce] 20130517 CESA-2013:0830 Important CentOS 6 kernel Update
- USN-1826-1
- [linux-kernel] 20130412 Re: sw_perf_event_destroy() oops while fuzzing
- USN-1838-1
- https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f
- USN-1828-1
- [CentOS-announce] 20130515 CentOS-6 CVE-2013-2094 Kernel Issue
- USN-1827-1
- USN-1836-1
- RHSA-2013:0830
- http://news.ycombinator.com/item?id=5703758
- [oss-security] 20130514 Re: CVE Request: linux kernel perf out-of-bounds access
- SUSE-SU-2013:0819
- openSUSE-SU-2013:0925
- http://www.reddit.com/r/netsec/comments/1eb9iw
- openSUSE-SU-2013:1042
- USN-1825-1
- openSUSE-SU-2013:0951
More Linux Kernel vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2021-05514 Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE KEVCVSS 3.1HIGH 8.3
- TI-2023-00252 Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel KEVCVSS 3.1HIGH 7.9
Sources
- CVE-2013-2094 · CVE Program
- CVE-2013-2094 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-xpgm-72rm-72p4 · GitHub Advisory Database · CC BY 4.0
- CVE-2013-2094 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences