CVE-2013-2851

CVE-2013-2851 is a format string vulnerability in the Linux kernel's register_disk function, specifically affecting versions through 3.9.4. This flaw allows local users with root access to gain privileges by injecting format string specifiers into the /sys/module/md_mod/parameters/new_array file, leading to the creation of a malicious /dev/md device name. With a CVSS score of 6.0, it is considered a medium severity vulnerability, requiring high attack complexity and authenticated access, but potentially leading to full confidentiality, integrity, and availability compromise. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.