CVE-2013-2597: Qualcomm MSM ACDB audio driver stack buffer overflow via ioctl

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityCVSS 3.1 base score is 8.4 (HIGH) and the flaw is in CISA KEV with known exploitation, though it requires local access to a specific device node.

What it is

The acdb_ioctl function in audio_acdb.c in the Linux kernel ACDB audio driver, as used in Qualcomm Innovation Center Android MSM contributions, has a stack-based buffer overflow. An application with access to /dev/msm_acdb can supply a large size value in an ioctl argument to overflow the stack. This matters because the driver is reachable from local applications on affected Android/MSM devices and can lead to privilege escalation.

Impact

An attacker gains elevated privileges on the device, with high impact to confidentiality, integrity and availability per the CVSS vector. In practice this means code execution in the context of the vulnerable driver, potentially reaching kernel or system-level privileges.

Attack surface

Reached locally through the /dev/msm_acdb device node via an ioctl call, per the description and the AV:L vector. No authentication or user interaction is required (PR:N, UI:N), but the attacker must already be able to run an application with access to that device node.

Exploitation

CVE-2013-2597 is listed in CISA KEV (added 2022-09-15), indicating known exploitation in the wild. EPSS 30-day probability is low at roughly 1.5 percent (73rd percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor update for the affected Code Aurora / Qualcomm MSM Android kernel per CISA KEV required action.
• If patching is not immediately possible, restrict or remove access to /dev/msm_acdb for untrusted applications and review device node permissions.
• Track affected devices through the vendor or carrier update channel and prioritize those still running unpatched MSM kernels.
• Validate ioctl size arguments in the ACDB driver if maintaining a custom kernel, as a compensating control until the official fix is applied.

Detection

• Monitor for unexpected or anomalous ioctl calls to /dev/msm_acdb, especially with unusually large size arguments.
• Audit which applications hold access to /dev/msm_acdb and alert on new or unexpected holders of that device node.
• Watch for privilege escalation or unexpected kernel-level activity originating from processes that interact with the ACDB audio driver.
• Use the CISA KEV entry to drive asset checks confirming affected MSM-based devices have received the vendor update.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.