CISA KEV · Known exploitedHigh

CVE-2013-2596

Linux Kernel

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.

CVSS: 7.8
EPSS: 3.37%
CISA KEV: Listed
Published: 2013.04.13

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability3.37%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Kernel
Affected versions: >= 2.6.12 < 3.0.75, >= 3.1 < 3.2.45, >= 3.3 < 3.4.42, >= 3.5 < 3.8.9, 4.1.2
Fixed versions: 3.0.75, 3.2.45, 3.4.42, 3.8.9

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.10.06

1
Identify
Confirm that Linux Kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-189, CWE-190
KEV added: 2022.09.15
Ransomware use: 미확인