PT-2011-2518 · Linux · Udev

Published 2011-01-25 · Updated 2022-06-03 · CVE-2011-0640

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions udev (affected versions not specified)

Description The default configuration of udev on Linux does not provide a warning before enabling additional Human Interface Device (HID) functionality over USB. This allows attackers to execute arbitrary programs via crafted USB data, such as keyboard and mouse data sent by malware on a connected smartphone.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

AZL-6516

CVE-2011-0640

Affected Products

Udev

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-0640 · Security Note
• https://osv.dev/vulnerability/AZL-6516 · Vendor Advisory
• http://cs.gmu.edu/~astavrou/publications.html · Note
• http://blackhat.com/html/bh-dc-11/bh-dc-11-briefings.html#Stavrou · Note
• http://news.cnet.com/8301-27080_3-20028919-245.html · Note