PT-2014-5126 · Linux+6 · Linux Kernel+7

Steven Vittitoe · Published 2014-09-28 · Updated 2024-06-06 · CVE-2014-3186

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 3.16.3

Description The issue allows physically proximate attackers to cause a denial of service or possibly execute arbitrary code via a crafted device that sends a large report, exploiting a buffer overflow in the picolcd raw event function in the PicoLCD HID device driver. This is particularly relevant in Android on Nexus 7 devices.

Recommendations For Linux kernel versions through 3.16.3, update to a version later than 3.16.3 to resolve the issue. As a temporary workaround, consider restricting access to the PicoLCD HID device driver to minimize the risk of exploitation.

Exploit

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2014_1971

CVE-2014-3186

OPENSUSE-SU-2014_1669-1

OPENSUSE-SU-2014_1677-1

RHSA-2014:1971

RHSA-2014_1971

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2376-1

USN-2377-1

USN-2378-1

USN-2379-1

Affected Products

Android

Centos

Linux Kernel

Nexus 7

Picolcd Hid Device Driver

Red Hat

Suse

Ubuntu

References · 38

• 🔥 https://github.com/RKX1209/CVE-2014-9322 · Exploit
• 🔥 https://code.google.com/p/google-security-research/issues/detail?id=101 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-3103.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-6410 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2379-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3181 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3186 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2378-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-2379-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3186 · Security Note
• https://ubuntu.com/security/CVE-2014-3185 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3186 · Security Note
• https://ubuntu.com/security/CVE-2014-6418 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3186 · Vendor Advisory