CVE-2013-0913

Vulnerability

An integer overflow flaw exists in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver of the Direct Rendering Manager (DRM) subsystem in the Linux kernel through version 3.8.3. The bug occurs when handling the allocation of a buffer used for relocation copies; a crafted application that triggers many relocation copies can overflow a size calculation, leading to a heap-based buffer overflow. The vulnerability is also present in Google Chrome OS before version 25.0.1364.173 [1][2].

Exploitation

A local user with console access can exploit this vulnerability by running a specially crafted application that causes an integer overflow during the relocation copy buffer allocation. The overflow can corrupt heap memory, and the condition potentially involves a race window that makes exploitation more complex but still feasible [1][2].

Impact

Successful exploitation allows a local attacker to cause a denial of service (system crash) or possibly escalate privileges to gain higher-level access on the affected system [1][3][4]. The impact is considered important by Red Hat and Ubuntu, with the potential for privilege escalation [1].

Mitigation

Updates are available from Red Hat (RHSA-2013-0744) [1] and Ubuntu (USN-1813-1 and USN-1812-1) [3][4]. Users should apply the patched kernel versions provided by their distribution. No workaround is documented in the available references, and the CVE is not listed on the KEV.