Denial of Service Vulnerability in Linux Kernel (CVE-2013-2058)
Summary
CVE-2013-2058: The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming option, which allows local users to cause a denial of service (system crash) by se... Affects linux versions < 3.8-1. Fixed in 3.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of hardware architectures and is known for its stability and performance. However, certain versions of the Linux kernel prior to 3.7.4 contain a vulnerability in the host_start function within the USB chipidea driver, which can lead to a denial of service when exploited.
Vulnerability Detail
CVE-2013-2058 is a vulnerability in the Linux kernel that affects the handling of USB/Ethernet adapters. The host_start function does not adequately support a specific non-streaming option, allowing local users to send excessive network traffic through a USB/Ethernet adapter. This can result in a system crash, leading to a denial of service. The vulnerability is particularly concerning as it can be exploited by local users, potentially affecting system availability and stability.
How To Fix
Minimum fixed version
3.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can limit the amount of network traffic sent through USB/Ethernet adapters or restrict access to local users who can exploit this vulnerability. However, the best solution is to apply the kernel update as mentioned above.
Conclusion
CVE-2013-2058 is a significant vulnerability in the Linux kernel that can lead to a denial of service through improper handling of USB/Ethernet traffic. Users are strongly advised to upgrade to a fixed version of the kernel to ensure system stability and security. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2013-2058 is a vulnerability in the Linux kernel that can lead to a denial of service by allowing local users to crash the system through excessive network traffic via USB/Ethernet adapters.
The vulnerability affects Linux kernel versions prior to 3.7.4.
You can check your Linux kernel version by running the command 'uname -r' in the terminal. If it is below 3.8-1, your system is vulnerable.
If an immediate upgrade is not possible, consider implementing traffic restrictions or limiting access to local users to mitigate the risk.
Vulert allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
