Denial of Service in Linux kernel HID subsystem (CVE-2013-2896)
Summary
CVE-2013-2896: drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer d... Affects linux versions < 3.10.11-1. Fixed in 3.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is an open-source monolithic Unix-like computer operating system kernel. It provides the core functionality for various Linux distributions. The Human Interface Device (HID) subsystem is responsible for managing input devices such as keyboards, mice, and touchscreens. The HID subsystem in the Linux kernel through version 3.11 is vulnerable to a denial of service attack when the HID N-trig driver (hid-ntrig.c) is enabled. This vulnerability can be exploited by physically proximate attackers.
Vulnerability Detail
The vulnerability (CVE-2013-2896) arises due to a NULL pointer dereference and OOPS (kernel panic) in the HID subsystem. Attackers in close physical proximity can exploit this flaw by using a crafted device. By triggering the vulnerability, they can cause the system to crash, resulting in a denial of service. The vulnerability was first published on September 16, 2013, and affects Linux kernel versions up to 3.11.
How To Fix
Minimum fixed version
3.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Linux kernel HID subsystem vulnerability (CVE-2013-2896) allows physically proximate attackers to cause a denial of service by crashing the system. It is recommended to update the Linux kernel to version 3.10.11-1 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows physically proximate attackers to cause a denial of service by crashing the system through a crafted device.
Linux kernel versions up to 3.11 are affected by this vulnerability.
You can use the Vulert playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
While the vulnerability has been disclosed, there is no known public exploit available at this time.
The urgency is considered low as the vulnerability requires physical proximity to exploit and has been fixed in Linux kernel version 3.10.11-1.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
