Denial of Service Vulnerability in Linux Kernel (CVE-2013-2899)
Summary
CVE-2013-2899: drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of service (NULL... Affects linux versions < 3.10.11-1. Fixed in 3.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a critical component of the Linux operating system, responsible for managing system resources and providing core functionality. The Human Interface Device (HID) subsystem is a part of the kernel that handles input devices such as keyboards, mice, and joysticks. The HID subsystem enables communication between these devices and the operating system. The HID subsystem in the Linux kernel through version 3.11 is vulnerable to a denial of service attack when the CONFIG_HID_PICOLCD configuration option is enabled. This vulnerability allows physically proximate attackers to cause a NULL pointer dereference and OOPS, resulting in a system crash.
Vulnerability Detail
The vulnerability (CVE-2013-2899) arises from a flaw in the drivers/hid/hid-picolcd_core.c file within the HID subsystem of the Linux kernel. When the CONFIG_HID_PICOLCD configuration option is enabled, an attacker in close physical proximity to the affected system can exploit this vulnerability to trigger a NULL pointer dereference and OOPS. By crafting a malicious device, the attacker can cause the system to crash, leading to a denial of service condition. This vulnerability has a low urgency rating.
How To Fix
Minimum fixed version
3.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the Linux kernel to the recommended version.
Conclusion
The Linux kernel's HID subsystem is vulnerable to a denial of service attack when the CONFIG_HID_PICOLCD configuration option is enabled. Physically proximate attackers can exploit this vulnerability to crash the system. To mitigate this risk, it is crucial to update the Linux kernel to version 3.10.11-1 or later. This update includes a patch that resolves the vulnerability. No known workarounds exist, and it is recommended to apply the provided fix as soon as possible. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows physically proximate attackers to crash the affected system, resulting in a denial of service condition. However, it does not grant remote code execution or privilege escalation capabilities.
Systems running the Linux kernel with the HID subsystem enabled and the CONFIG_HID_PICOLCD configuration option enabled are affected by this vulnerability. Specifically, Debian 10, 11, 12, and 13 with the Linux package installed are impacted.
There is no known public exploit for this vulnerability at the time of this report. However, it is advisable to apply the recommended fix to mitigate any potential risk.
No, this vulnerability requires physical proximity to the affected system. Remote exploitation is not possible.
No, the recommended solution is to update the Linux kernel to the fixed version. Applying any other patches or workarounds may not fully address the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
