High severity · published Aug 31, 2014
CVE-2013-2597
Code Aurora ACDB Audio Driver Stack-based Buffer Overflow Vulnerability
In wildKEV
8.4
CVSS
1.5%
EPSS
Yes
On KEV
Description
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that leverages /dev/msm_acdb access and provides a large size value in an ioctl argument.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 15, 2022
Federal remediation dueOct 6, 2022
Ransomware campaign useNot known
Affected products
Which versions
AN
Android-msm · Codeaurora
2.6.29; 3.2.54; 3.2.55; 3.2.56; 3.2.57; 3.2.58; +34 more · source: NVD
AA
ACDB Audio Driver · Code Aurora
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2597
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2597
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-acdb-audio-driver-cve-2013-2597
More from Android-msm
–
CVE-2013-6124
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink…
–
CVE-2013-2599
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF)…
–
CVE-2013-2598
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows…
–
CVE-2013-2595
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM…
–
CVE-2014-0972
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent…