PT-2014-2598 · Linux · Linux Kernel

Published 2014-08-31 · Updated 2025-02-10 · CVE-2013-2597

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 2.6.x through 3.x

Description The issue is a stack-based buffer overflow in the acdb ioctl function in audio acdb.c in the acdb audio driver. This allows attackers to gain privileges via an application that leverages /dev/msm acdb access and provides a large size value in an ioctl argument. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Linux kernel versions 2.6.x through 3.x, as a temporary workaround, consider restricting access to the /dev/msm acdb device file to minimize the risk of exploitation. Additionally, avoid providing large size values in ioctl arguments to the acdb ioctl function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-121

CWE-119

Related Identifiers

CVE-2013-2597

Affected Products

Linux Kernel

References · 6

• 🔥 https://github.com/fi01/libmsm_acdb_exploit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2597 · Security Note
• https://codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-acdb-audio-driver-cve-2013-2597 · Vendor Advisory
• https://web.archive.org/web/20161226013354/https:/www.codeaurora.org/news/security-advisories/stack-based-buffer-overflow-acdb-audio-driver-cve-2013-2597 · Security Note
• https://t.me/cvenotify/105042 · Telegram Post
• https://t.me/cvenotify/110663 · Telegram Post