Improper input validation in Linux Kernel

CVE-2013-4254

The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by adding a hardware event to an event group led by a software event.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.004 (34.9th percentile) — read the EPSS interpretation.