HackerFeeds
All CVEs

CVE-2013-2596

HIGH7.8
CISA KEV

Published 2013-04-13 · Updated 2026-06-16 · Source cve@mitre.org

Summary

CVE-2013-2596 is a high-severity (CVSS 7.8) vulnerability in Linux Kernel. CISA added it to the Known Exploited Vulnerabilities catalog on September 15, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 6, 2022. CISA does not currently list it as used in ransomware campaigns. Linux has 32 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

All 32 known-exploited Linux vulnerabilities →

Description

Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-190CWE-190

CISA Known-Exploited Vulnerability

Product: Linux — Kernel

Name: Linux Kernel Integer Overflow Vulnerability

Date added: 2022-09-15 · Due: 2022-10-06

Required action: Apply updates per vendor instructions.

References

View on NVD