CVE-2013-1860: Buffer Overflow
Heap-based buffer overflow in the wdmincallback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.
Other sources
Linux kernel built with USB CDC WDM driver is vulnerable to heap buffer overflow flaw.
An unprivileged local user could use this flaw to crash the kernel or, potentially, elevate their privileges.
Please note that a physical access to the system or plugging in random USB device is needed in order to exploit this bug.
Upstream fix: ------------- -> https://git.kernel.org/linus/c0f5ecee4e741667b2493c742b60b6218d40b3aa
Reference: ----------- -> http://www.openwall.com/lists/oss-security/2013/03/14/12
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1860?
CVE-2013-1860 has a severity level that can lead to denial of service or arbitrary code execution.
How do I fix CVE-2013-1860?
To fix CVE-2013-1860, update the Linux kernel to a version later than 3.8.4.
Which Linux kernel versions are affected by CVE-2013-1860?
The affected Linux kernel versions include those before 3.8.4, specifically versions 3.0.70 up to 3.4.37.
Can CVE-2013-1860 be exploited by remote attackers?
CVE-2013-1860 requires a physically proximate attacker for exploitation.
What impact does CVE-2013-1860 have on systems?
The impact of CVE-2013-1860 includes potential system crashes and the possibility of executing arbitrary code.