CVE-2013-2596 · netVigilance record NV22-0516

Linux Kernel Integer Overflow

past due

What to do

Apply updates per vendor instructions.

CISA deadline 2022-10-06 · passed 3 years 11 months ago · applies to US federal civilian agencies; used elsewhere as a reference SLA

What happened

Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.

Who is affected

Linux Kernel. Affected version ranges are listed in the vendor advisory and the NVD entry linked under Sources.

Weakness class: CWE-189.

Timeline

2022-09-15
Added to CISA KEVExploitation in the wild confirmed by CISA
2022-10-06
CISA remediation deadlinepassed 3 years 11 months ago

Sources

NVD entry for CVE-2013-2596 nvd.nist.gov/vuln/detail/CVE-2013-2596
CISA Known Exploited Vulnerabilities catalog www.cisa.gov/known-exploited-vulnerabilities-catalog
git.kernel.org git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fc9bbca8f650e5f738af8806317c0a041a48ae4a
nvd.nist.gov nvd.nist.gov/vuln/detail/CVE-2013-2596