CVE-2014-3181

Published: 28 September 2014

Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.

From the Ubuntu security team

Steven Vittitoe reported multiple stack buffer overflows in Linux kernel's magicmouse HID driver. A physically proximate attacker could exploit this flaw to cause a denial of service (system crash) or possibly execute arbitrary code via specially crafted devices.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3181
• https://code.google.com/p/google-security-research/issues/detail?id=100
• http://www.openwall.com/lists/oss-security/2014/09/11
• https://git.kernel.org/linus/c54def7bd64d7c0b6993336abcffb8444795bf38
• https://ubuntu.com/security/notices/USN-2376-1
• https://ubuntu.com/security/notices/USN-2377-1
• https://ubuntu.com/security/notices/USN-2378-1
• https://ubuntu.com/security/notices/USN-2379-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1370025