CVE-2013-2888
published 2013-09-16CVE-2013-2888: Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate…
PriorityP429medium6.2CVSS 2.0
AVLACHAuNCCICAC
EPSS
0.48%
38.7th percentile
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
Affected
228 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.10.11-1 (bookworm) | linux 3.10.11-1 (bookworm) |
| linux | linux_kernel | <= 3.11 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.06.2MEDIUMAV:L/AC:H/Au:N/C:C/I:C/A:C
osv6.2MEDIUM
vendor_debian6.2MEDIUM
vendor_redhat6.2MEDIUM
vendor_ubuntu3.2LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v997-8gmf-mpww: Multiple array index errors in drivers/hid/hid-core
ghsa_unreviewed·2022-05-17
CVE-2013-2888 [MEDIUM] CWE-20 GHSA-v997-8gmf-mpww: Multiple array index errors in drivers/hid/hid-core
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
OSV
CVE-2013-2888: Multiple array index errors in drivers/hid/hid-core
osv·2013-09-16·CVSS 6.2
CVE-2013-2888 [MEDIUM] CVE-2013-2888: Multiple array index errors in drivers/hid/hid-core
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
Kernel
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
kernel_security·2013-09-06·CVSS 6.2
CVE-2013-2888 [MEDIUM] Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid
Pull HID updates from Jiri Kosina:
"Highlights:
- conversion of HID subsystem to use devm-based resource management,
from Benjamin Tissoires
- i2c-hid support for DT bindings, from Benjamin Tissoires
- much improved support for Win8-multitouch devices, from Benjamin
Tissoires
- cleanup of core code using common hidinput_input_event(), from
David Herrmann
- fix for bug in implement() access to the bit stream (causing oops)
that has been present in the code for ages, but devices that are
able to trigger it have started to appear only now, from Jiri
Kosina
- fixes for CVE-2013-2899, CVE-2013-2898, CVE-2013-2896,
CVE-2013-2892, CVE-2013-2888 (all triggerable only by specially
crafted malicious HW devices
Kernel
Merge branch 'for-3.11/CVE-2013-2888' into for-3.12/upstream
kernel_security·2013-09-04·CVSS 6.2
CVE-2013-2888 [MEDIUM] Merge branch 'for-3.11/CVE-2013-2888' into for-3.12/upstream
Merge branch 'for-3.11/CVE-2013-2888' into for-3.12/upstream
This one didn't make it for 3.11 due to being applied too close
to release, queue it for 3.12 merge window.
Signed-off-by: Jiri Kosina
Kernel
HID: validate HID report id size
kernel_security·2013-08-28·CVSS 6.2
CVE-2013-2888 [MEDIUM] HID: validate HID report id size
HID: validate HID report id size
The "Report ID" field of a HID report is used to build indexes of
reports. The kernel's index of these is limited to 256 entries, so any
malicious device that sets a Report ID greater than 255 will trigger
memory corruption on the host:
[ 1347.156239] BUG: unable to handle kernel paging request at ffff88094958a878
[ 1347.156261] IP: [] hid_register_report+0x2a/0x8b
CVE-2013-2888
Signed-off-by: Kees Cook
Cc: [email protected]
Signed-off-by: Jiri Kosina
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2013-12-07·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
Dan Carpenter discovered an information leak in the HP Smart Array and
Compaq SMART2 disk-array driver in the Linux kernel. A local user could
exploit this flaw to obtain sensitive information from kernel memory.
(CVE-2013-2147)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of
the Linux kernel. A physically proximate attacker could exploit th
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2013-12-03·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
A flaw was discovered in the Xen subsystem of the Linux kernel when it
provides read-only access to a disk that supports TRIM or SCSI UNMAP to a
guest OS. A privileged user in the guest OS could exploit this flaw to
destroy data on the disk, even though the guest OS should not be able to
write to the disk. (CVE-2013-2140)
Kees Cook discovered flaw in the Human Interface Devic
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2013-12-03·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
A flaw was discovered in the Xen subsystem of the Linux kernel when it
provides read-only access to a disk that supports TRIM or SCSI UNMAP to a
guest OS. A privileged user in the guest OS could exploit this flaw to
destroy data on the disk, even though the guest OS should not be able to
write to the disk. (CVE-2013-2140)
Kees Cook discovered flaw in the Human Interfa
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2013-11-08·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of
the Linux kernel. A physically proximate attacker could exploit this flaw
to execute arbitrary code or cause a denial of service (heap memory
corruption) via a specially crafted device that provides an invalid Report
ID. (CVE-2013-2888)
Kees Cook discovered flaw in the Human Interface Device (H
Ubuntu
Linux kernel (Quantal HWE) vulnerabilities
vendor_ubuntu·2013-11-08·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel (Quantal HWE) vulnerabilities
Title: Linux kernel (Quantal HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of
the Linux kernel. A physically proximate attacker could exploit this flaw
to execute arbitrary code or cause a denial of service (heap memory
corruption) via a specially crafted device that provides an invalid Report
ID. (CVE-2013-2888)
Kees Cook discovered flaw in the Human Interface Dev
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2013-11-08·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of
the Linux kernel. A physically proximate attacker could exploit this flaw
to execute arbitrary code or cause a denial of service (heap memory
corruption) via a specially crafted device that provides an invalid Report
ID. (CVE-2013-2888)
Kees Cook discovered flaw in the Human Interface Device (HID) subs
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2013-10-22·CVSS 2.1
CVE-2013-2237 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the Linux kernel when reading
broadcast messages from the notify_policy interface of the IPSec
key_socket. A local user could exploit this flaw to examine potentially
sensitive information in kernel memory. (CVE-2013-2237)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of
the Linux kernel. A physically proximate attacker could exploit this flaw
to execute arbitrary code or cause a denial of service (heap memory
corruption) via a specially crafted device that provides an invalid Report
ID. (CVE-2013-2888)
Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem
of the Linux kerenl when CONFIG_HID_PANTHERLORD is ena
Ubuntu
Linux kernel (Raring HWE) vulnerabilities
vendor_ubuntu·2013-10-22·CVSS 2.1
CVE-2013-2237 [LOW] Linux kernel (Raring HWE) vulnerabilities
Title: Linux kernel (Raring HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the Linux kernel when reading
broadcast messages from the notify_policy interface of the IPSec
key_socket. A local user could exploit this flaw to examine potentially
sensitive information in kernel memory. (CVE-2013-2237)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of
the Linux kernel. A physically proximate attacker could exploit this flaw
to execute arbitrary code or cause a denial of service (heap memory
corruption) via a specially crafted device that provides an invalid Report
ID. (CVE-2013-2888)
Kees Cook discovered a flaw in the Human Interface Device (HID) subsystem
of the Linux kerenl when CONFIG_HID_PANTH
Ubuntu
Linux kernel (EC2) vulnerabilities
vendor_ubuntu·2013-09-30·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel (EC2) vulnerabilities
Title: Linux kernel (EC2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of
the Linux kernel. A physically proximate attacker could exploit this flaw
to execute arbitrary code or cause a denial of service (heap memory
corruption) via a specially crafted device that provides an invalid Report
ID. (CVE-2013-2888)
Kees Cook discovered a flaw in the Human Interface Device (H
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2013-09-30·CVSS 3.2
CVE-2013-0343 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
An information leak was discovered in the handling of ICMPv6 Router
Advertisement (RA) messages in the Linux kernel's IPv6 network stack. A
remote attacker could exploit this flaw to cause a denial of service
(excessive retries and address-generation outage), and consequently obtain
sensitive information. (CVE-2013-0343)
Kees Cook discovered flaw in the Human Interface Device (HID) subsystem of
the Linux kernel. A physically proximate attacker could exploit this flaw
to execute arbitrary code or cause a denial of service (heap memory
corruption) via a specially crafted device that provides an invalid Report
ID. (CVE-2013-2888)
Kees Cook discovered a flaw in the Human Interface Device (HID) su
Red Hat
Kernel: HID: memory corruption flaw
vendor_redhat·2013-08-29·CVSS 6.2
CVE-2013-2888 [MEDIUM] Kernel: HID: memory corruption flaw
Kernel: HID: memory corruption flaw
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
Statement: This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.
Note: user would need physical access to the system to exploit this issue.
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2013-2888: linux - Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Dev...
vendor_debian·2013·CVSS 6.2
CVE-2013-2888 [MEDIUM] CVE-2013-2888: linux - Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Dev...
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.
Scope: local
bookworm: resolved (fixed in 3.10.11-1)
bullseye: resolved (fixed in 3.10.11-1)
forky: resolved (fixed in 3.10.11-1)
sid: resolved (fixed in 3.10.11-1)
trixie: resolved (fixed in 3.10.11-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-2888 Kernel: HID: memory corruption flaw [fedora-all]
bugzilla·2013-08-29·CVSS 6.2
CVE-2013-2888 [MEDIUM] CVE-2013-2888 Kernel: HID: memory corruption flaw [fedora-all]
CVE-2013-2888 Kernel: HID: memory corruption flaw [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects multiple s
Bugzilla
CVE-2013-2888 Kernel: HID: memory corruption flaw
bugzilla·2013-08-23·CVSS 6.2
CVE-2013-2888 [MEDIUM] CVE-2013-2888 Kernel: HID: memory corruption flaw
CVE-2013-2888 Kernel: HID: memory corruption flaw
Linux kernel built with the Human Interface Device bus (CONFIG_HID) or USB Human
Interface Device(CONFIG_USB_HID) support is vulnerable to a memory corruption flaw. It could occur if an HID device sends malicious HID report with the Report_ID of greater than 255.
A local user with physical access to the system could use this flaw to crash
the system resulting in DoS or, potentially, escalate their privileges on the system.
Upstream fix:
-> https://git.kernel.org/linus/43622021d2e2b82ea03d883926605bdd0525e1d1
Discussion:
Statement:
This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.
Note: user would need physical access to the system to exploit this issue.
--
http://marc.info/?l=linux-input&m=137772180514608&w=1http://openwall.com/lists/oss-security/2013/08/28/13http://rhn.redhat.com/errata/RHSA-2013-1490.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1645.htmlhttp://www.debian.org/security/2013/dsa-2766http://www.ubuntu.com/usn/USN-1976-1http://www.ubuntu.com/usn/USN-1977-1http://www.ubuntu.com/usn/USN-1995-1http://www.ubuntu.com/usn/USN-1998-1http://www.ubuntu.com/usn/USN-2019-1http://www.ubuntu.com/usn/USN-2021-1http://www.ubuntu.com/usn/USN-2022-1http://www.ubuntu.com/usn/USN-2024-1http://www.ubuntu.com/usn/USN-2038-1http://www.ubuntu.com/usn/USN-2039-1http://www.ubuntu.com/usn/USN-2050-1http://marc.info/?l=linux-input&m=137772180514608&w=1http://openwall.com/lists/oss-security/2013/08/28/13http://rhn.redhat.com/errata/RHSA-2013-1490.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1645.htmlhttp://www.debian.org/security/2013/dsa-2766http://www.ubuntu.com/usn/USN-1976-1http://www.ubuntu.com/usn/USN-1977-1http://www.ubuntu.com/usn/USN-1995-1http://www.ubuntu.com/usn/USN-1998-1http://www.ubuntu.com/usn/USN-2019-1http://www.ubuntu.com/usn/USN-2021-1http://www.ubuntu.com/usn/USN-2022-1http://www.ubuntu.com/usn/USN-2024-1http://www.ubuntu.com/usn/USN-2038-1http://www.ubuntu.com/usn/USN-2039-1http://www.ubuntu.com/usn/USN-2050-1
2013-09-16
Published