CVE-2013-2094: Linux Kernel perf_swevent_init Integer Type Flaw Enables Local Privilege Escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityAlthough the CVSS score is 8.4 (High) and the flaw requires local access, it is listed in CISA KEV with a very high EPSS percentile, confirming active exploitation and making it a top remediation priority for any unpatched Linux host.

What it is

The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, allowing a local user to escalate privileges via a crafted perf_event_open system call. Because the flaw is in core kernel event handling, any unprivileged local account on an affected system can potentially obtain root. It is a well-known, widely exploited local privilege escalation issue.

Impact

An attacker with local access gains full root privileges, including the ability to read or modify any data, install persistent malware, or disable security controls. This is a complete compromise of the host's confidentiality, integrity, and availability.

Attack surface

Reached locally by invoking the perf_event_open system call with crafted arguments; no authentication beyond an existing local user session is required, and no user interaction is needed. The CVSS vector confirms local access (AV:L), no privileges (PR:N), and no user interaction (UI:N).

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-09-15, and public exploit code exists (e.g., the semtex.c exploit on Packet Storm and Exploit-DB). EPSS gives a 30-day exploitation probability of 0.477 (98.8th percentile), indicating active exploitation is likely.

What to do

• Apply the Linux kernel 3.8.9 or later update, or the corresponding vendor kernel update from Red Hat, CentOS, Ubuntu, openSUSE, or Mandriva.
• If immediate patching is not possible, restrict local shell access and use mandatory access control (SELinux/AppArmor) to limit unprivileged users' ability to invoke perf_event_open.
• Disable or restrict the perf_event subsystem for unprivileged users via the kernel.perf_event_paranoid sysctl where operationally feasible.
• Audit all Linux hosts for kernel versions before 3.8.9 and prioritize remediation on multi-user or internet-facing systems.
• Monitor for and remove any unauthorized local accounts or persistence mechanisms that may have been established before patching.

Detection

• Monitor process execution for known exploit binaries or scripts that call perf_event_open with unusual arguments, such as semtex.c or similar privilege escalation tools.
• Audit system logs for unexpected root-level process creation or privilege changes originating from unprivileged user sessions.
• Use host-based intrusion detection to flag anomalous use of the perf_event_open syscall by non-root users.
• Check for signs of post-exploitation activity such as new SUID binaries, modified kernel modules, or unauthorized cron jobs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.