CVE-2011-0640 The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitr...
MediumCVSS 6.9
EPSS 0.35%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device (HID) functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the user connected to the computer.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| udev project udev | All versions | No fix listed |
References
- news.cnet.com broken-link
- www.blackhat.com not-applicable
- www.cs.gmu.edu broken-link