Heap-based Out-of-Bounds Write in Linux Kernel HID Subsystem
Summary
CVE-2013-2891: drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_STEELSERIES is enabled, allows physically proximate attackers to cause a denial of service (he... Affects linux versions < 3.11.5-1. Fixed in 3.11.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. The Human Interface Device (HID) subsystem in the Linux kernel enables support for HID devices such as keyboards, mice, and game controllers. One of the drivers in this subsystem is hid-steelseries.c, which is responsible for handling SteelSeries HID devices. These devices are commonly used for gaming purposes. However, a vulnerability exists in the HID subsystem when CONFIG_HID_STEELSERIES is enabled, allowing physically proximate attackers to trigger a denial of service (DoS) condition by exploiting a heap-based out-of-bounds write flaw in the hid-steelseries.c driver.
Vulnerability Detail
The vulnerability, identified as CVE-2013-2891, was first published on September 16, 2013. It affects the Linux kernel versions up to 3.11. The flaw arises due to improper bounds checking in the hid-steelseries.c driver, which can be exploited by an attacker in close physical proximity to the affected system. By sending specially crafted input to a SteelSeries HID device, an attacker can trigger a heap-based out-of-bounds write, leading to a DoS condition. This vulnerability has a low urgency rating.
How To Fix
Minimum fixed version
3.11.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The heap-based out-of-bounds write vulnerability in the Linux kernel's HID subsystem, specifically in the hid-steelseries.c driver, can be exploited by physically proximate attackers to cause a denial of service (DoS) condition. To mitigate this vulnerability, it is crucial to update the Linux kernel to version 3.11.5-1 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows physically proximate attackers to cause a denial of service (DoS) condition on the affected system by exploiting a heap-based out-of-bounds write flaw in the hid-steelseries.c driver.
The vulnerability affects Linux kernel versions up to 3.11.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
Yes, updating the Linux kernel to version 3.11.5-1 or later will address this vulnerability. Make sure to check for updates from your Linux distribution's package repositories.
This vulnerability has a low urgency rating.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.