Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Linux kernel ARM lets local user escalate or crash

CVE-2013-4254 · published 13 years ago
Summary

On Linux kernels older than version 3.10.8 that run on ARM processors, a routine that checks performance events can be tricked by a regular user. By adding a specific hardware event to a group that starts with a software event, the user can either gain higher system privileges or cause the system to crash. Updating the kernel to a newer version or applying the available patches resolves the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
linux linux_kernel <= 3.10.7
3.10.0
3.10.1
3.10.2
3.10.3
3.10.4
3.10.5
3.10.6
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:arm64:*
Original advisory text
The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer de...
The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by adding a hardware event to an event group led by a software event.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published25 Aug 2013
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-4254 · NVD
Track software like this
Free during beta