Vulnerability Details : CVE-2014-3184
The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c.
Vulnerability category: OverflowDenial of service
Products affected by CVE-2014-3184
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.16.0:*:*:*:*:*:*:*
Threat overview for CVE-2014-3184
Top countries where our scanners detected CVE-2014-3184
Top open port discovered on systems with this issue
49152
IPs affected by CVE-2014-3184 18,246
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2014-3184!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2014-3184
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 18 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-3184
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.7
|
MEDIUM | AV:L/AC:M/Au:N/C:N/I:N/A:C |
3.4
|
6.9
|
NIST |
CWE ids for CVE-2014-3184
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3184
-
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
[security-announce] SUSE-SU-2015:0481-1: important: Security update for
-
http://www.ubuntu.com/usn/USN-2376-1
USN-2376-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
[security-announce] openSUSE-SU-2015:0566-1: important: kernel update fo
-
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.2
Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
[security-announce] SUSE-SU-2015:0652-1: important: Security update for
-
http://www.ubuntu.com/usn/USN-2374-1
USN-2374-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-2377-1
USN-2377-1: Linux kernel (OMAP4) vulnerabilities | Ubuntu security notices
-
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4ab25786c87eb20857bbb715c3ae34ec8fd6a214
kernel/git/torvalds/linux.git - Linux kernel source treePatch
-
http://www.ubuntu.com/usn/USN-2378-1
USN-2378-1: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security notices
-
http://www.openwall.com/lists/oss-security/2014/09/11/21
oss-security - Multiple Linux USB driver CVE assignment
-
https://bugzilla.redhat.com/show_bug.cgi?id=1141391
1141391 – (CVE-2014-3184) CVE-2014-3184 Kernel: HID: off by one error in various _report_fixup routinesPatch
-
http://www.ubuntu.com/usn/USN-2375-1
USN-2375-1: Linux kernel (EC2) vulnerabilities | Ubuntu security notices
-
http://rhn.redhat.com/errata/RHSA-2015-1272.html
RHSA-2015:1272 - Security Advisory - Red Hat Customer Portal
-
http://www.securityfocus.com/bid/69768
Linux Kernel CVE-2014-3184 Multiple Local Denial Of Service Vulnerabilities
-
http://rhn.redhat.com/errata/RHSA-2014-1318.html
RHSA-2014:1318 - Security Advisory - Red Hat Customer Portal
-
https://code.google.com/p/google-security-research/issues/detail?id=91
91 - Linux kernel HID report fixup multiple off-by-one issues - project-zero - MonorailPatch
-
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
[security-announce] SUSE-SU-2015:0812-1: important: Security update for
-
http://www.ubuntu.com/usn/USN-2379-1
USN-2379-1: Linux kernel vulnerabilities | Ubuntu security notices
-
https://github.com/torvalds/linux/commit/4ab25786c87eb20857bbb715c3ae34ec8fd6a214
HID: fix a couple of off-by-ones · torvalds/linux@4ab2578 · GitHub
Jump to