The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2013-2094 from the MITRE CVE dictionary dictionary and NIST NVD.
This issue does not affect the kernel packages as shipped with Red Hat Enterprise Linux 5 because we did not backport upstream commit b0a873eb that introduced this issue.
This issue was addressed in Red Hat Enterprise Linux 6 via RHSA-2013:0830 (https://rhn.redhat.com/errata/RHSA-2013-0830.html), Red Hat Enterprise Linux 6.1 Extended update support via RHSA-2013:0841 (https://rhn.redhat.com/errata/RHSA-2013-0841.html), Red Hat Enterprise Linux 6.2 Extended update support via RHSA-2013:0840 (https://rhn.redhat.com/errata/RHSA-2013-0840.html), Red Hat Enterprise Linux 6.3 Extended Update Support via RHSA-2013:0832 (https://rhn.redhat.com/errata/RHSA-2013-0832.html), and Red Hat Enterprise MRG 2 via RHSA-2013:0829 (https://rhn.redhat.com/errata/RHSA-2013-0829.html).
Red Hat Enterprise Linux 6.0 was not affected by this flaw.
Refer to https://access.redhat.com/site/solutions/373743 for further information.
| Base Score | 7.2 |
|---|---|
| Base Metrics | AV:L/AC:L/Au:N/C:C/I:C/A:C |
| Access Vector | Local |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | Complete |
| Integrity Impact | Complete |
| Availability Impact | Complete |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux 6 (kernel) | RHSA-2013:0830 | 2013-05-16 |
| Red Hat Enterprise Linux Extended Update Support 6.2 (kernel) | RHSA-2013:0840 | 2013-05-20 |
| Red Hat MRG Grid for RHEL 6 Server v.2 (kernel-rt) | RHSA-2013:0829 | 2013-05-20 |
| Red Hat Enterprise Linux Extended Update Support 6.3 (kernel) | RHSA-2013:0832 | 2013-05-17 |
| Red Hat Enterprise Linux Server EUS (v. 6.1) (kernel) | RHSA-2013:0841 | 2013-05-20 |
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 5 | kernel | Not affected |
Vulmon