CVE-2013-2596

2013-04-1302:59:00

CWE-189

[email protected]

web.nvd.nist.gov

567

In Wild

cve-2013-2596

integer overflow

fb_mmap function

linux kernel

local users

privileges

nvd

security vulnerability

5.9 Medium

AI Score

Confidence

High

6.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

0.009 Low

EPSS

Percentile

82.6%

JSON

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.

CPENameOperatorVersion
linux:linux_kernellinux linux kernellt3.0.75
linux:linux_kernellinux linux kernellt3.2.45
linux:linux_kernellinux linux kernellt3.4.42
linux:linux_kernellinux linux kernellt3.8.9
motorola:androidmotorola androideq4.1.2

CPE	Name	Operator	Version
linux:linux_kernel	linux linux kernel	lt	3.0.75
linux:linux_kernel	linux linux kernel	lt	3.2.45
linux:linux_kernel	linux linux kernel	lt	3.4.42
linux:linux_kernel	linux linux kernel	lt	3.8.9
motorola:android	motorola android	eq	4.1.2