Heap-based out-of-bounds write in Linux kernel HID subsystem
Summary
CVE-2013-2889: drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service (heap-based o... Affects linux versions < 3.11.5-1. Fixed in 3.11.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing the system's resources and providing an interface for applications to interact with the hardware. The Human Interface Device (HID) subsystem in the Linux kernel enables support for various input devices such as keyboards, mice, and game controllers. One of the drivers in the HID subsystem is hid-zpff.c. This driver is vulnerable to a heap-based out-of-bounds write when the CONFIG_HID_ZEROPLUS configuration option is enabled.
Vulnerability Detail
The vulnerability, identified as CVE-2013-2889, allows physically proximate attackers to cause a denial of service by exploiting a flaw in the hid-zpff.c driver. By sending a specially crafted device to the system, an attacker can trigger a heap-based out-of-bounds write, leading to a system crash or potential code execution. This vulnerability affects the Linux kernel versions up to 3.11.
How To Fix
Minimum fixed version
3.11.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the Linux kernel to a patched version.
Conclusion
The heap-based out-of-bounds write vulnerability in the Linux kernel's HID subsystem poses a risk of denial of service and potential code execution. It is crucial to update the Linux kernel to version 3.11.5-1 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows physically proximate attackers to cause a denial of service by exploiting a flaw in the Linux kernel's HID subsystem. This can lead to system crashes or potential code execution.
The vulnerability affects Linux kernel versions up to 3.11.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including CVE-2013-2889.
No, there is no known workaround for this vulnerability. It is crucial to update the Linux kernel to a patched version.
You can find more information about this vulnerability in the CVE-2013-2889 JSON report available at https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2013-2889.json.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
