CVE-2013-2094

The Linux kernel's perf event subsystem fails to validate all 64 bits of the attr.config value supplied from user space, causing an out-of-bounds access to the perf_swevent_enabled array in sw_perf_event_destroy(). A local attacker triggers the flaw by creating a perf event with a crafted attr.config value, and the out-of-bounds access occurs when that event is destroyed, corrupting adjacent kernel memory. By corrupting memory this way, an attacker can escalate privileges from an unprivileged local user to kernel-level (root) privileges on the affected system. Any system running an affected Linux kernel where perf events are available is exposed; the provided data does not specify exact affected kernel version ranges, so operators should confirm against vendor advisories. The vulnerability is actively exploited: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-15, and EPSS assigns it a 47.7% probability of exploitation within 30 days (99th percentile).

What to do: Apply kernel updates per vendor instructions as required by CISA, then reboot so the system runs the patched kernel. As interim mitigation, restrict unprivileged access to perf events (e.g., by raising the perf_event_paranoid sysctl) and limit untrusted local shell access. Verify the running kernel version against your distribution's advisory for this CVE before and after remediation.