CVE-2014-3186: Buffer Overflow
Buffer overflow in the picolcdrawevent function in devices/hid/hid-picolcdcore.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.
Other sources
Linux kernel built with the Human Interface Device(HID) Bus support(CONFIGHID) along with a driver for Minibox PicoLCD devices support(CONFIGHIDPICOLCD), is vulnerable to an OOB write flaw. It could occur if a device offers an HID report with arbitrary(>64) data size value.
A local user with physical access to the system could use this flaw to crash the system resulting in DoS or potentially, escalate their privileges on the system.
Upstream fix: ------------- -> https://git.kernel.org/linus/844817e47eef14141cf59b8d5ac08dd11c0a9189
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2014/09/11/22
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3186?
CVE-2014-3186 is classified as a high severity vulnerability due to its potential for denial of service and execution of arbitrary code.
How do I fix CVE-2014-3186?
To fix CVE-2014-3186, you should update your Linux kernel to a version beyond 3.16.3 or apply the appropriate patches.
Who is impacted by CVE-2014-3186?
CVE-2014-3186 affects users of the Linux kernel versions up to and including 3.16.3, including devices like the Google Nexus 7.
What type of vulnerability is CVE-2014-3186?
CVE-2014-3186 is a buffer overflow vulnerability within the PicoLCD HID device driver in the Linux kernel.
Is CVE-2014-3186 exploitable remotely?
CVE-2014-3186 requires physical access, making it not remotely exploitable under typical conditions.