Sensitive Information Disclosure in Linux HID Subsystem
Summary
CVE-2013-2898: drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive information fr... Affects linux versions < 3.10.11-1. Fixed in 3.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. The Human Interface Device (HID) subsystem in the Linux kernel enables communication with input devices such as keyboards, mice, and sensors. One component of the HID subsystem is the hid-sensor-hub driver, which handles sensor-related functionality. This vulnerability, identified as CVE-2013-2898, affects the Linux kernel versions up to 3.11 when the CONFIG_HID_SENSOR_HUB configuration option is enabled. It allows attackers in close physical proximity to the system to access sensitive information from the kernel memory by exploiting a flaw in the hid-sensor-hub driver.
Vulnerability Detail
The vulnerability arises due to a lack of proper input validation in the hid-sensor-hub driver. By sending specially crafted input to the driver, an attacker can trigger a memory disclosure issue, potentially exposing sensitive information stored in the kernel memory. This information could include cryptographic keys, passwords, or other confidential data. As the attack requires physical proximity to the system, the impact is limited to scenarios where an attacker can directly interact with the HID device.
How To Fix
Minimum fixed version
3.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can disable the CONFIG_HID_SENSOR_HUB configuration option in the kernel build configuration if it is not required for their system. This can be done by modifying the kernel configuration file and rebuilding the kernel. However, this workaround may not be feasible for all users, especially those who rely on the HID sensor functionality.
Conclusion
The sensitive information disclosure vulnerability in the Linux HID subsystem poses a risk to systems with the CONFIG_HID_SENSOR_HUB configuration option enabled. It is crucial for users to update their Linux kernel to version 3.10.11-1 or later to mitigate this vulnerability. Alternatively, users can consider disabling the CONFIG_HID_SENSOR_HUB option if it is not required. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows physically proximate attackers to obtain sensitive information from the kernel memory, potentially exposing confidential data.
No, the vulnerability requires physical proximity to the system to exploit.
The vulnerability affects Linux kernel versions up to 3.11 when the CONFIG_HID_SENSOR_HUB configuration option is enabled.
There are no known instances of this vulnerability being exploited in the wild.
Disabling the HID subsystem entirely is not recommended as it would render input devices such as keyboards and mice unusable.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
