Description
The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.8.11-1 | — |
| Debian 13 | linux | 3.8.11-1 | — |
| Debian 12 | linux | 3.8.11-1 | — |
| Debian 7 | linux | 3.2.41-2+deb7u2 | DSA-2669-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +15 | 2.6.32-358.6.2.el6 | RHSA-2013:0830 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6.3 EUS | perf +15 | 2.6.32-279.25.2.el6 | RHSA-2013:0832 |
| RHEL 6.2 EUS | perf +15 | 2.6.32-220.34.2.el6 | RHSA-2013:0840 |
| RHEL 6.1 EUS | perf +14 | 2.6.32-131.39.1.el6 | RHSA-2013:0841 |
| Red Hat MRG 2 | kernel-rt +11 | 3.6.11.2-rt33.39.el6rt | RHSA-2013:0829 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.22.1-2 | — |
| Azure Linux 2 (CBL-Mariner) | kernel | 5.15.153.1-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- Linux Kernel 3.2.0-23/3.5.0-23 (Ubuntu 12.04/12.04.1/12.04.2 x64) - 'perf_swevent_init' Local Privilege Escalation (3) EDB-33589 · local · May 31, 2014 · verified
- Linux Kernel < 3.8.9 (x86-64) - 'perf_swevent_init' Local Privilege Escalation (2) EDB-26131 · local · Jun 11, 2013 · verified
- Linux Kernel 2.6.32 < 3.x (CentOS 5/6) - 'PERF_EVENTS' Local Privilege Escalation (1) EDB-25444 · local · May 14, 2013
GitHub 7 repositories
-
realtalk/cve-2013-2094 ★ 91 · May 20, 2013
original cve-2013-2094 exploit and a rewritten version for educational purposes
-
hiikezoe/libperf_event_exploit ★ 17 · Jun 5, 2013
CVE-2013-2094 exploit for android
-
Pashkela/CVE-2013-2094 ★ 4 · Jun 16, 2013
CVE-2013-2094 Linux 2.6.32/2.6.37 - 3.8.10 PERF_EVENTS local root x86/x86_64
-
timhsutw/cve-2013-2094 ★ 3 · Mar 29, 2015
CVE-2013-2094 kernel exploit for i386
-
vnik5287/CVE-2013-2094 ★ 1 · Jul 23, 2019
perf_swevent_init
-
letsr00t/CVE-2013-2094 ★ 0 · Dec 1, 2025
-
tarunyadav/fix-cve-2013-2094 ★ 0 · Jun 18, 2013
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2013:0829 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:0830 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:0832 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2013:0840 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2669-1 linux - several Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2013:0841 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Feb 19, 2026
References
- openSUSE-SU-2013:0847 vendor-advisory
- MDVSA-2013:176 vendor-advisory
- [linux-kernel] 20130413 Re: sw_perf_event_destroy() oops while fuzzing mailing-list
- [linux-kernel] 20130412 sw_perf_event_destroy() oops while fuzzing mailing-list
- [CentOS-announce] 20130517 CESA-2013:0830 Important CentOS 6 kernel Update mailing-list
- USN-1826-1 vendor-advisory
- [linux-kernel] 20130412 Re: sw_perf_event_destroy() oops while fuzzing mailing-list
- USN-1838-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=962792
- https://github.com/torvalds/linux/commit/8176cced706b5e5d15887584150764894e94e02f
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9
- USN-1828-1 vendor-advisory
- [CentOS-announce] 20130515 CentOS-6 CVE-2013-2094 Kernel Issue mailing-list
- USN-1827-1 vendor-advisory
- USN-1836-1 vendor-advisory
- 93361 vdb-entry
- 33589 exploit
- RHSA-2013:0830 vendor-advisory
- http://news.ycombinator.com/item?id=5703758
- [oss-security] 20130514 Re: CVE Request: linux kernel perf out-of-bounds access mailing-list
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8176cced706b5e5d15887584150764894e94e02f
- SUSE-SU-2013:0819 vendor-advisory
- http://packetstormsecurity.com/files/121616/semtex.c
- openSUSE-SU-2013:0925 vendor-advisory
- http://twitter.com/djrbliss/statuses/334301992648331267
- http://www.reddit.com/r/netsec/comments/1eb9iw
- openSUSE-SU-2013:1042 vendor-advisory
- USN-1825-1 vendor-advisory
- openSUSE-SU-2013:0951 vendor-advisory