Denial of Service Vulnerability in Linux Package: CVE-2013-2896
Summary
DEBIAN-CVE-2013-2896: drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer d... Affects linux versions < 3.10.11-1. Fixed in 3.10.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and software interactions. It supports a wide range of devices and is crucial for system stability and performance. This vulnerability specifically affects the Human Interface Device (HID) subsystem, which handles input devices like keyboards and mice.
Vulnerability Detail
The vulnerability identified as CVE-2013-2896 exists in the drivers/hid/hid-ntrig.c file within the Linux kernel up to version 3.11. When the CONFIG_HID_NTRIG option is enabled, it allows physically proximate attackers to exploit a NULL pointer dereference, leading to a denial of service (system crash). This can occur through specially crafted devices, making it a significant risk for systems that utilize HID devices.
How To Fix
Minimum fixed version
3.10.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the CONFIG_HID_NTRIG option in the kernel configuration if it is not needed for their hardware. This can prevent the vulnerability from being exploited until the package is updated.
Conclusion
CVE-2013-2896 is a critical vulnerability in the Linux kernel that can lead to denial of service attacks via the HID subsystem. Users are strongly advised to update their systems to the patched version to mitigate risks. Temporary workarounds are available, but updating is the best long-term solution.
See every vulnerability recorded for linux →
FAQ
CVE-2013-2896 is a vulnerability in the Linux kernel that allows denial of service attacks through the HID subsystem.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Not addressing this vulnerability can lead to system crashes and potential downtime, especially in environments relying on HID devices.
Yes, the vulnerability affects Linux kernel versions up to 3.11, specifically when CONFIG_HID_NTRIG is enabled.
If immediate updates are not possible, consider disabling the CONFIG_HID_NTRIG option as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
