Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Linux kernel perf_swevent_enabled array out-of-bound access privilege escalation vulnerability
Informations
Name VU#774103 First vendor Publication 2013-05-17
Vendor VU-CERT Last vendor Modification 2013-05-17
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#774103

Linux kernel perf_swevent_enabled array out-of-bound access privilege escalation vulnerability

Original Release date: 17 May 2013 | Last revised: 17 May 2013

Overview

The Linux kernel's Performance Events implementation is susceptible to an out-of-bounds array vulnerability that may be used by a local unprivileged user to escalate privileges.

Description

The Linux kernel's Performance Events implementation is susceptible to an out-of-bounds array vulnerability that may be used by a local unprivileged user to escalate privileges. Additional analysis of the vulnerability may be found in the Red Hat bug report. A public exploit is available that has been reported to work against some Linux distributions.

Impact

A local authenticated user may be able to exploit this vulnerability to escalate privileges.

Solution

Apply an Update

Red Hat, Debian, CentOS, and Ubuntu have all released patches. Users should receive the patches through their Linux distributions' normal update process.

Affected Distributions

  • Red Hat Enterprise Linux 6 & Red Hat Enterprise MRG 2
  • CentOS 6
  • Debian 7.0 (Wheezy)
  • Ubuntu 12.04 LTS, 12.10, 13.04
Other distributions may be affected but were not confirmed at the time of publication.

If you are unable to upgrade, please consider the following workaround.

Red Hat has provided mitigation advice in Red Hat Knowledge Solution 373743.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
CentOSAffected-17 May 2013
Debian GNU/LinuxAffected-17 May 2013
Red Hat, Inc.Affected-17 May 2013
UbuntuAffected-17 May 2013
Fedora ProjectUnknown-17 May 2013
Slackware Linux Inc.Unknown-17 May 2013
SUSE LinuxUnknown-17 May 2013
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base6.8AV:L/AC:L/Au:S/C:C/I:C/A:C
Temporal5.9E:ND/RL:OF/RC:C
Environmental4.4CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

  • https://rhn.redhat.com/errata/RHSA-2013-0830.html
  • http://www.debian.org/security/2013/dsa-2669
  • http://www.ubuntu.com/usn/usn-1825-1/
  • http://www.ubuntu.com/usn/usn-1826-1/
  • http://www.ubuntu.com/usn/usn-1827-1/
  • http://www.ubuntu.com/usn/usn-1828-1/
  • http://lists.centos.org/pipermail/centos-announce/2013-May/019729.html
  • http://lists.centos.org/pipermail/centos-announce/2013-May/019733.html
  • https://bugzilla.redhat.com/show_bug.cgi?id=962792
  • https://bugzilla.redhat.com/show_bug.cgi?id=962792#c16
  • https://bugzilla.redhat.com/show_bug.cgi?id=962799
  • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b0a873ebbf87bf38bf70b5e39a7cadc96099fa13
  • http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/kernel/events/core.c?id=8176cced706b5e5d15887584150764894e94e02f
  • http://packetstormsecurity.com/files/121616/semtex.c
  • http://lkml.indiana.edu/hypermail/linux/kernel/1304.1/03652.html
  • http://www.reddit.com/r/netsec/comments/1eb9iw/sdfucksheeporgs_semtexc_local_linux_root_exploit/c9ykrck

Credit

Tommi Rantala discovered this vulnerability.

This document was written by Jared Allar.

Other Information

  • CVE IDs:CVE-2013-2094
  • Date Public:14 May 2013
  • Date First Published:17 May 2013
  • Date Last Updated:17 May 2013
  • Document Revision:26

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/774103

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-189 Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:17404
 
Oval ID: oval:org.mitre.oval:def:17404
Title: USN-1828-1 -- linux-lts-quantal vulnerability
Description: The system could be made to run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1828-1
CVE-2013-2094
 Version: 7
Platform(s): Ubuntu 12.04
 Product(s): linux-lts-quantal
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18242
 
Oval ID: oval:org.mitre.oval:def:18242
Title: USN-1826-1 -- linux vulnerability
Description: The system could be made to run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1826-1
CVE-2013-2094
 Version: 7
Platform(s): Ubuntu 12.10
 Product(s): linux
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18266
 
Oval ID: oval:org.mitre.oval:def:18266
Title: USN-1827-1 -- linux vulnerability
Description: The system could be made to run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1827-1
CVE-2013-2094
 Version: 7
Platform(s): Ubuntu 13.04
 Product(s): linux
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18310
 
Oval ID: oval:org.mitre.oval:def:18310
Title: USN-1825-1 -- linux vulnerability
Description: The system could be made to run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1825-1
CVE-2013-2094
 Version: 7
Platform(s): Ubuntu 12.04
 Product(s): linux
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20874
 
Oval ID: oval:org.mitre.oval:def:20874
Title: RHSA-2013:0830: kernel security update (Important)
Description: The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Family: unix Class: patch
Reference(s): RHSA-2013:0830-01
CESA-2013:0830
CVE-2013-2094
 Version: 4
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24010
 
Oval ID: oval:org.mitre.oval:def:24010
Title: ELSA-2013:0830: kernel security update (Important)
Description: The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Family: unix Class: patch
Reference(s): ELSA-2013:0830-01
CVE-2013-2094
 Version: 6
Platform(s): Oracle Linux 6
 Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25556
 
Oval ID: oval:org.mitre.oval:def:25556
Title: SUSE-SU-2013:0819-1 -- Security update for the Linux Kernel (x86)
Description: This update to the SUSE Linux Enterprise 11 SP2 kernel fixes the following critical security issue: * A bounds checking problem in the perf systemcall could be used by local attackers to crash the kernel or execute code in kernel context. (CVE-2013-2094 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2094 > )
Family: unix Class: patch
Reference(s): SUSE-SU-2013:0819-1
CVE-2013-2094
 Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
 Product(s): the Linux Kernel (x86)
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27494
 
Oval ID: oval:org.mitre.oval:def:27494
Title: ELSA-2013-2524 -- Unbreakable Enterprise kernel Security update (critical)
Description: [2.6.39-400.24.1] - perf: Treat attr.config as u64 in perf_swevent_init() (Tommi Rantala) [Orabug: 16808734] {CVE-2013-2094}
Family: unix Class: patch
Reference(s): ELSA-2013-2524
CVE-2013-2094
 Version: 3
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): kernel-uek
kernel-uek-debug
kernel-uek-debug-devel
kernel-uek-devel
kernel-uek-doc
kernel-uek-firmware
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27667
 
Oval ID: oval:org.mitre.oval:def:27667
Title: DEPRECATED: ELSA-2013-0830 -- kernel security update (important)
Description: [2.6.32-358.6.2] - [kernel] perf: fix perf_swevent_enabled array out-of-bound access (Petr Matousek) [962793 962794] {CVE-2013-2094}
Family: unix Class: patch
Reference(s): ELSA-2013-0830
CVE-2013-2094
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): kernel
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Os 1821

ExploitDB Exploits

id Description
2013-06-11 Linux kernel perf_swevent_init - Local root Exploit

Nessus® Vulnerability Scanner

Date Description
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-0832.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL14445.nasl - Type : ACT_GATHER_INFO
2014-07-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-0829.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-512.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-454.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-452.nasl - Type : ACT_GATHER_INFO
2014-03-20 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-190.nasl - Type : ACT_GATHER_INFO
2013-09-18 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-2546.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-0830.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-2524.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-2525.nasl - Type : ACT_GATHER_INFO
2013-06-25 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-176.nasl - Type : ACT_GATHER_INFO
2013-05-31 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1849-1.nasl - Type : ACT_GATHER_INFO
2013-05-29 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2013-140-01.nasl - Type : ACT_GATHER_INFO
2013-05-22 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_kernel-130515.nasl - Type : ACT_GATHER_INFO
2013-05-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-0841.nasl - Type : ACT_GATHER_INFO
2013-05-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-0840.nasl - Type : ACT_GATHER_INFO
2013-05-21 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-0830.nasl - Type : ACT_GATHER_INFO
2013-05-17 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20130516_kernel_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-05-17 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-0830.nasl - Type : ACT_GATHER_INFO
2013-05-17 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2669.nasl - Type : ACT_GATHER_INFO
2013-05-16 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1827-1.nasl - Type : ACT_GATHER_INFO
2013-05-16 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1828-1.nasl - Type : ACT_GATHER_INFO
2013-05-16 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1826-1.nasl - Type : ACT_GATHER_INFO
2013-05-16 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1825-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
Date Informations
2014-03-21 13:21:30
  • Multiple Updates
2013-05-30 13:26:44
  • Multiple Updates
2013-05-17 21:18:16
  • First insertion