Buffer overflow in Linux Kernel

CVE-2014-3186

Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.

Vulnerability class: Buffer Overflow

EPSS: 0.007 (49.5th percentile) — read the EPSS interpretation.

Affected products

Linux Linux_kernel
Canonical Ubuntu_linux — versions 12.04, 14.04
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

chrome-cve-admin@google.com (mailing-list, x_refsource_MLIST, Mailing List)
chrome-cve-admin@google.com (x_refsource_CONFIRM, Third Party Advisory)
chrome-cve-admin@google.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
chrome-cve-admin@google.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
chrome-cve-admin@google.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
chrome-cve-admin@google.com (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
chrome-cve-admin@google.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
chrome-cve-admin@google.com (x_refsource_CONFIRM, Vendor Advisory)
chrome-cve-admin@google.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
chrome-cve-admin@google.com (Third Party Advisory, x_refsource_MISC)