Denial of Service Vulnerability in Linux Package: CVE-2013-2889
Summary
DEBIAN-CVE-2013-2889: drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service (heap-based o... Affects linux versions < 3.11.5-1. Fixed in 3.11.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It includes various subsystems, including the Human Interface Device (HID) subsystem, which facilitates communication between the operating system and input devices. This vulnerability specifically affects the HID subsystem when the CONFIG_HID_ZEROPLUS option is enabled, making it susceptible to attacks that can lead to system instability.
Vulnerability Detail
The vulnerability identified as CVE-2013-2889 exists in the hid-zpff.c file of the Linux kernel, affecting versions up to 3.11. It allows physically proximate attackers to exploit a heap-based out-of-bounds write, leading to a denial of service. This can occur when a crafted device is connected, potentially causing the system to crash or become unresponsive. The issue arises from improper handling of input data from HID devices, which can be manipulated to trigger the vulnerability.
How To Fix
Minimum fixed version
3.11.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the CONFIG_HID_ZEROPLUS option in the kernel configuration if you do not require support for ZeroPlus HID devices. This can be done by modifying the kernel configuration file and recompiling the kernel, although this approach is more complex and may not be feasible for all users.
Conclusion
CVE-2013-2889 represents a significant vulnerability in the Linux kernel's HID subsystem, allowing for denial of service attacks through crafted devices. Users are encouraged to update their systems to the patched version to mitigate risks associated with this vulnerability. For those unable to update immediately, disabling the relevant kernel option may serve as a temporary measure.
See every vulnerability recorded for linux →
FAQ
CVE-2013-2889 is a vulnerability in the Linux kernel's HID subsystem that allows for a denial of service through a heap-based out-of-bounds write.
Users of Debian operating systems running vulnerable versions of the Linux kernel with CONFIG_HID_ZEROPLUS enabled are affected.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If immediate updates are not possible, consider disabling the CONFIG_HID_ZEROPLUS option as a temporary workaround, but be aware that this may limit functionality with certain HID devices.
While the primary risk is a denial of service, which may cause the system to crash, there is no direct indication of data loss. However, system instability can lead to unexpected behavior.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
