Critical Vulnerability in Linux Package: Array Index Errors in HID Subsystem
Summary
DEBIAN-CVE-2013-2888: Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of ser... Affects linux versions < 3.10.11-1. Fixed in 3.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and software interactions. It supports a wide range of devices and is known for its stability and performance. However, vulnerabilities can arise, such as the one identified in the Human Interface Device (HID) subsystem, which can lead to severe security risks.
Vulnerability Detail
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through version 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service due to heap memory corruption via a crafted device that provides an invalid Report ID. This vulnerability can lead to unauthorized access and manipulation of system resources, posing a significant threat to system integrity.
How To Fix
Minimum fixed version
3.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit physical access to the systems to prevent exploitation of this vulnerability until the package is updated.
Conclusion
The identified vulnerability in the Linux package's HID subsystem poses significant risks, including arbitrary code execution and denial of service. It is crucial to update to the patched version 3.10.11-1 to mitigate these risks. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves array index errors that can lead to arbitrary code execution or denial of service.
The vulnerability affects all versions of the Linux package through version 3.11.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, the patched version of the Linux package is 3.10.11-1.
If immediate updates are not possible, limit physical access to the system as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.