{"identifier":"CVE-2013-2596","cve":{"id":"CVE-2013-2596","description":"Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.","published":"2013-04-13T02:59:46.627000+00:00","modified":"2026-06-16T23:53:41.450000+00:00","status":"Analyzed","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"3.0.75"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"3.2.45"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"3.4.42"},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"3.8.9"},{"criteria":"cpe:2.3:o:motorola:android:4.1.2:*:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""}],"weaknesses":["CWE-190"],"references":[{"url":"http://forum.xda-developers.com/showthread.php?t=2255491","source":"cve@mitre.org","tags":["Exploit"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b4cbb197c7e7a68dbad0d491242e3ca67420c13e","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fc9bbca8f650e5f738af8806317c0a041a48ae4a","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=linux-kernel&m=136616837923938&w=2","source":"cve@mitre.org","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0695.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0782.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0803.html","source":"cve@mitre.org","tags":["Third Party Advisory"]},{"url":"http://www.droid-life.com/2013/04/09/root-method-released-for-droid-razr-hd-running-android-4-1-2-other-devices-too/","source":"cve@mitre.org","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"http://www.droidrzr.com/index.php/topic/15208-root-motochopper-yet-another-android-root-exploit/","source":"cve@mitre.org","tags":["Exploit","Issue Tracking"]},{"url":"http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9","source":"cve@mitre.org","tags":["Mailing List","Release Notes"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:176","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","source":"cve@mitre.org","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/59264","source":"cve@mitre.org","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/torvalds/linux/commit/b4cbb197c7e7a68dbad0d491242e3ca67420c13e","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://github.com/torvalds/linux/commit/fc9bbca8f650e5f738af8806317c0a041a48ae4a","source":"cve@mitre.org","tags":["Exploit","Patch"]},{"url":"http://forum.xda-developers.com/showthread.php?t=2255491","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b4cbb197c7e7a68dbad0d491242e3ca67420c13e","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fc9bbca8f650e5f738af8806317c0a041a48ae4a","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://marc.info/?l=linux-kernel&m=136616837923938&w=2","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0695.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0782.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0803.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"http://www.droid-life.com/2013/04/09/root-method-released-for-droid-razr-hd-running-android-4-1-2-other-devices-too/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"http://www.droidrzr.com/index.php/topic/15208-root-motochopper-yet-another-android-root-exploit/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking"]},{"url":"http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Release Notes"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:176","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/59264","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/torvalds/linux/commit/b4cbb197c7e7a68dbad0d491242e3ca67420c13e","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://github.com/torvalds/linux/commit/fc9bbca8f650e5f738af8806317c0a041a48ae4a","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-2596","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}],"kev":{"cveID":"CVE-2013-2596","vendorProject":"Linux","product":"Kernel","vulnerabilityName":"Linux Kernel Integer Overflow Vulnerability","dateAdded":"2022-09-15","shortDescription":"Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.","requiredAction":"Apply updates per vendor instructions.","dueDate":"2022-10-06","knownRansomwareCampaignUse":"Unknown","forensicTriage":"No","notes":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fc9bbca8f650e5f738af8806317c0a041a48ae4a; https://nvd.nist.gov/vuln/detail/CVE-2013-2596","cwes":["CWE-189"]},"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:C/I:C/A:C","baseScore":6.9,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"MEDIUM","exploitabilityScore":3.4,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-05-01T03:55:10.585625Z","id":"CVE-2013-2596","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"3.0.75","matchCriteriaId":"F6BFD971-9FC9-4D37-99FC-9E39178942E2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1","versionEndExcluding":"3.2.45","matchCriteriaId":"88DA168C-393B-4853-8034-6E9099CC9623"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3","versionEndExcluding":"3.4.42","matchCriteriaId":"8FECB4AF-F9DF-44E3-BD62-741D5D129053"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.5","versionEndExcluding":"3.8.9","matchCriteriaId":"7E3C2571-AFE5-4ED0-810D-232092DD0220"},{"vulnerable":true,"criteria":"cpe:2.3:o:motorola:android:4.1.2:*:*:*:*:*:*:*","matchCriteriaId":"62EFFAAF-F122-4019-8554-9E9CEF73CDAE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:motorola:atrix_hd:-:*:*:*:*:*:*:*","matchCriteriaId":"75B24D97-F98A-4A1A-B20E-EB6D610C71EA"},{"vulnerable":false,"criteria":"cpe:2.3:h:motorola:razr_hd:-:*:*:*:*:*:*:*","matchCriteriaId":"A5D2D0B7-8170-46F2-9FC8-2DDD3E96DE66"},{"vulnerable":false,"criteria":"cpe:2.3:h:motorola:razr_m:-:*:*:*:*:*:*:*","matchCriteriaId":"01FE07B3-068A-4C2A-A985-631070C17F51"},{"vulnerable":false,"criteria":"cpe:2.3:h:qualcomm:msm8960:-:*:*:*:*:*:*:*","matchCriteriaId":"73B9587B-78D0-4057-B694-E1E6655F624F"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T16:14:09.476518+00:00","exploited":true,"kev_stale":false,"products":["linux / linux kernel","motorola / android"],"priority":{"label":"Known exploitation: prioritize review","reasons":["CISA KEV lists real-world exploitation."]},"epss":{"probability":0.03212,"percentile":0.88149,"date":"2026-10-29","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"forum.xda-developers.com","source_url":"http://forum.xda-developers.com/showthread.php?t=2255491","investigate_url":"https://investigate.aeglixmind.com/#forum.xda-developers.com"},{"domain":"git.kernel.org","source_url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b4cbb197c7e7a68dbad0d491242e3ca67420c13e","investigate_url":"https://investigate.aeglixmind.com/#git.kernel.org"},{"domain":"kb.juniper.net","source_url":"http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761","investigate_url":"https://investigate.aeglixmind.com/#kb.juniper.net"},{"domain":"marc.info","source_url":"http://marc.info/?l=linux-kernel&m=136616837923938&w=2","investigate_url":"https://investigate.aeglixmind.com/#marc.info"},{"domain":"rhn.redhat.com","source_url":"http://rhn.redhat.com/errata/RHSA-2015-0695.html","investigate_url":"https://investigate.aeglixmind.com/#rhn.redhat.com"},{"domain":"www.droid-life.com","source_url":"http://www.droid-life.com/2013/04/09/root-method-released-for-droid-razr-hd-running-android-4-1-2-other-devices-too/","investigate_url":"https://investigate.aeglixmind.com/#www.droid-life.com"},{"domain":"www.droidrzr.com","source_url":"http://www.droidrzr.com/index.php/topic/15208-root-motochopper-yet-another-android-root-exploit/","investigate_url":"https://investigate.aeglixmind.com/#www.droidrzr.com"},{"domain":"www.kernel.org","source_url":"http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.9","investigate_url":"https://investigate.aeglixmind.com/#www.kernel.org"},{"domain":"www.mandriva.com","source_url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:176","investigate_url":"https://investigate.aeglixmind.com/#www.mandriva.com"},{"domain":"www.oracle.com","source_url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html","investigate_url":"https://investigate.aeglixmind.com/#www.oracle.com"},{"domain":"www.securityfocus.com","source_url":"http://www.securityfocus.com/bid/59264","investigate_url":"https://investigate.aeglixmind.com/#www.securityfocus.com"},{"domain":"github.com","source_url":"https://github.com/torvalds/linux/commit/b4cbb197c7e7a68dbad0d491242e3ca67420c13e","investigate_url":"https://investigate.aeglixmind.com/#github.com"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2013-2596","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2013-2596","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2013-2596","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}