Denial of Service Vulnerability in Linux Kernel HID Subsystem - CVE-2013-2892
Summary
DEBIAN-CVE-2013-2892: drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service (heap-based... Affects linux versions < 3.10.11-1. Fixed in 3.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. The Human Interface Device (HID) subsystem is responsible for managing input devices such as keyboards, mice, and game controllers. This subsystem is crucial for user interaction with the system, and vulnerabilities within it can lead to significant security risks.
Vulnerability Detail
The vulnerability identified as CVE-2013-2892 exists in the HID subsystem of the Linux kernel versions up to 3.11, specifically when the CONFIG_HID_PANTHERLORD option is enabled. It allows physically proximate attackers to exploit a heap-based out-of-bounds write, potentially leading to a denial of service. This could result in system instability or crashes, affecting the overall functionality of the operating system.
How To Fix
Minimum fixed version
3.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the CONFIG_HID_PANTHERLORD option in the kernel configuration if it is not needed for your system's functionality. This can be done by modifying the kernel configuration file and recompiling the kernel, though this is a more advanced solution and should be approached with caution.
Conclusion
CVE-2013-2892 represents a significant vulnerability in the Linux kernel's HID subsystem, allowing for potential denial of service attacks. It is crucial for users to update their systems to the patched version to mitigate risks. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2013-2892 is a vulnerability in the Linux kernel's HID subsystem that allows for a denial of service due to a heap-based out-of-bounds write.
If you are using a version of the Linux kernel prior to 3.10.11-1 and have the CONFIG_HID_PANTHERLORD option enabled, your system is vulnerable.
The primary risk is a denial of service, which can cause system crashes or instability, affecting the usability of the operating system.
Yes, the vulnerability has been patched in version 3.10.11-1 and later. It is advisable to update to this version or newer.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
