CVE-2013-4254

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.10.8

Description The issue allows local users to gain privileges or cause a denial of service, resulting in a system crash due to a NULL pointer dereference. This is achieved by adding a hardware event to an event group led by a software event through the validate event function in arch/arm/kernel/perf event.c on the ARM platform.

Recommendations For Linux kernel versions prior to 3.10.8, update to version 3.10.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the validate event function in arch/arm/kernel/perf event.c to minimize the risk of exploitation. Avoid adding hardware events to event groups led by software events until the issue is resolved.