Description
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.9-1 | — |
| Debian 13 | linux | 3.9-1 | — |
| Debian 12 | linux | 3.9-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | linux-raspi2 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +6 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +16 | 2.6.32-504.el6 | RHSA-2014:1392 |
| RHEL 5 | kernel +12 | 2.6.18-409.el5 | RHSA-2016:0450 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 6 | perf +9 | 2.6.32-220.60.2.el6 | RHSA-2015:0695 |
| RHEL 6.5 EUS | perf +16 | 2.6.32-431.53.2.el6 | RHSA-2015:0782 |
| RHEL 6.4 AUS | perf +9 | 2.6.32-358.59.1.el6 | RHSA-2015:0803 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
hiikezoe/libfb_mem_exploit ★ 6 · Jul 16, 2013
CVE-2013-2596 exploit for android
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 5
- RHSA-2015:0803 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:0782 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:0695 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:0450 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:1392 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2015:0695 vendor-advisory
- 59264 vdb-entry
- http://www.droid-life.com/2013/04/09/root-method-released-for-droid-razr-hd-running-android-4-1-2-other-devices-too/
- MDVSA-2013:176 vendor-advisory
- [linux-kernel] 20130417 Device driver memory 'mmap()' function helper cleanup mailing-list
- https://github.com/torvalds/linux/commit/b4cbb197c7e7a68dbad0d491242e3ca67420c13e
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b4cbb197c7e7a68dbad0d491242e3ca67420c13e
- RHSA-2015:0803 vendor-advisory
- http://forum.xda-developers.com/showthread.php?t=2255491
- http://www.droidrzr.com/index.php/topic/15208-root-motochopper-yet-another-android-root-exploit/
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9
- RHSA-2015:0782 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- https://github.com/torvalds/linux/commit/fc9bbca8f650e5f738af8806317c0a041a48ae4a
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fc9bbca8f650e5f738af8806317c0a041a48ae4a