PT-2014-5126 · Linux+6 · Linux Kernel+7

Steven Vittitoe · Publicado 2014-09-28 · Atualizado 2024-06-06 · CVE-2014-3186

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 3.16.3

Description The issue allows physically proximate attackers to cause a denial of service or possibly execute arbitrary code via a crafted device that sends a large report, exploiting a buffer overflow in the picolcd raw event function in the PicoLCD HID device driver. This is particularly relevant in Android on Nexus 7 devices.

Recommendations For Linux kernel versions through 3.16.3, update to a version later than 3.16.3 to resolve the issue. As a temporary workaround, consider restricting access to the PicoLCD HID device driver to minimize the risk of exploitation.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CESA-2014_1971

CVE-2014-3186

OPENSUSE-SU-2014_1669-1

OPENSUSE-SU-2014_1677-1

RHSA-2014:1971

RHSA-2014_1971

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2376-1

USN-2377-1

USN-2378-1

USN-2379-1

Produtos afetados

Android

Centos

Linux Kernel

Nexus 7

Picolcd Hid Device Driver

Red Hat

Suse

Ubuntu

Referências · 38

• 🔥 https://github.com/RKX1209/CVE-2014-9322 · Exploit
• 🔥 https://code.google.com/p/google-security-research/issues/detail?id=101 · Exploit
• https://github.com/torvalds/linux/commit/844817e47eef14141cf59b8d5ac08dd11c0a9189 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2014-3103.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-6410 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2379-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-3181 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-3186 · Aviso do Fabricante
• http://securityfocus.com/bid/69763 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1141407 · Nota
• https://ubuntu.com/security/notices/USN-2378-1 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-2379-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3186 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/09/11/22 · Nota