CVE-2013-2599

CVE-2013-2599 is a medium-severity vulnerability in Codeaurora Android-msm with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

• Severity: Medium (CVSS 2.0 base score 5.0)
• EPSS exploit prediction: 1% (51st percentile)
• Actively exploited: Not listed in CISA KEV
• Affected product: Codeaurora Android-msm
• Published: 2014-08-31
• Last modified: 2026-06-16

Description

A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption passwords via a logcat call.

Frequently asked questions

What is CVE-2013-2599?

A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption passwords via a logcat call.

How severe is CVE-2013-2599?

CVE-2013-2599 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2013-2599 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2013-2599?

CVE-2013-2599 primarily affects Codeaurora Android-msm. In total, 171 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2013-2599?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2013-2599 published?

CVE-2013-2599 was published on 2014-08-31 and last updated on 2026-06-16.

References

• https://www.codeaurora.org/projects/security-advisories/logging-potentially-sensitive-information-nativedaemonconnector-cve-2013-2599

Affected products (171)

• cpe:2.3:o:codeaurora:android-msm:3.2.54:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.2.55:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.2.56:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.2.57:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.2.58:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.2.59:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.2.60:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.2.61:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.2.62:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.72:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.73:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.74:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.75:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.76:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.77:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.78:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.79:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.80:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.81:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.82:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.83:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.84:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.85:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.86:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.87:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.88:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.89:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.90:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.91:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.92:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.93:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.94:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.95:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.96:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.97:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.98:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.99:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.100:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.101:*:*:*:*:*:*:*
• cpe:2.3:o:codeaurora:android-msm:3.4.102:*:*:*:*:*:*:*

More vulnerabilities in Codeaurora Android-msm

• CVE-2013-2597 — High (CVSS 8.4): Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel…
• CVE-2013-4736 — High (CVSS 7.8): Multiple integer overflows in the JPEG engine drivers in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as…
• CVE-2013-2595 — High (CVSS 7.2): The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in…
• CVE-2014-0972 — High (CVSS 7.2): The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions…
• CVE-2013-4738 — High (CVSS 7.2): Multiple stack-based buffer overflows in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation…
• CVE-2013-6123 — Medium (CVSS 6.9): Multiple array index errors in drivers/media/video/msm/server/msm_cam_server.c in the MSM camera driver for the Linux…

All CVEs affecting Codeaurora Android-msm →