Denial of Service Vulnerability in Linux Package: CVE-2013-2058
Summary
DEBIAN-CVE-2013-2058: The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming option, which allows local users to cause a denial of service (system crash) by se... Affects linux versions < 3.8-1. Fixed in 3.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It supports a wide range of devices and interfaces, making it a critical part of system stability and performance. This vulnerability specifically affects the USB/Ethernet adapter functionality, which can lead to system crashes under certain conditions.
Vulnerability Detail
The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before version 3.7.4 does not properly support a non-streaming option. This flaw allows local users to send a large amount of network traffic through a USB/Ethernet adapter, potentially causing a denial of service by crashing the system. The vulnerability is particularly concerning as it can be exploited by users with local access, leading to significant disruptions in service.
How To Fix
Minimum fixed version
3.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, limiting access to local users and monitoring network traffic can help reduce the risk of exploitation.
Conclusion
CVE-2013-2058 is a significant vulnerability in the Linux package that can lead to system crashes through denial of service. It is crucial for users to update their systems to the patched version to ensure stability and security. Monitoring tools like Vulert can assist in identifying such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2013-2058 is a vulnerability in the Linux kernel that can lead to a denial of service by crashing the system when a large amount of network traffic is sent through a USB/Ethernet adapter.
The vulnerability affects the Linux kernel versions prior to 3.7.4. It is advisable to upgrade to version 3.8-1 or later.
You can check your system's Linux kernel version by running 'uname -r' in the terminal. If it is below 3.7.4, your system is vulnerable.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If you cannot update the package, consider limiting local user access and monitoring network traffic to reduce the risk of exploitation until an update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.