Denial of Service Vulnerability in Linux Kernel's HID Multitouch Driver
Summary
DEBIAN-CVE-2013-2897: Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to c... Affects linux versions < 3.11.5-1. Fixed in 3.11.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The HID (Human Interface Device) subsystem allows for the management of input devices such as keyboards and mice. The vulnerability in question affects the HID multitouch driver, which is responsible for handling multitouch input from devices like touchscreens. This vulnerability arises when the CONFIG_HID_MULTITOUCH option is enabled, exposing systems to potential attacks.
Vulnerability Detail
Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through version 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service. This can result in heap memory corruption or NULL pointer dereference, leading to system crashes (OOPS). The vulnerability is identified as DEBIAN-CVE-2013-2897.
How To Fix
Minimum fixed version
3.11.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating is not immediately possible, consider disabling the CONFIG_HID_MULTITOUCH option in the kernel configuration to mitigate the risk until a proper update can be applied.
Conclusion
The vulnerability identified as DEBIAN-CVE-2013-2897 poses a significant risk to systems using the Linux kernel with the HID multitouch driver enabled. It is crucial for users to update their systems to the patched version to mitigate potential attacks and ensure system stability.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves multiple array index errors in the HID multitouch driver, which can lead to denial of service.
Physically proximate attackers can exploit this vulnerability, meaning they need physical access to the device.
Exploitation can result in system crashes, memory corruption, and overall instability of the affected system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Yes, updating to the patched version 3.11.5-1 or later will permanently fix the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.