CVE-2014-3181

What it actually does

Multiple stack-based buffer overflows in the magicmouse_raw_event function allow memory corruption from excessive EHCI or XHCI data supplied by a crafted HID device, resulting in denial of service or arbitrary code execution.

Why it matters to the business

Affected Linux systems risk sudden crashes or full compromise when a malicious USB device is connected, potentially causing downtime or unauthorized access with physical proximity.

How an attack unfolds

An attacker with physical access attaches a crafted Magic Mouse-emulating device that floods the driver with oversized event data via EHCI or XHCI, triggering the buffer overflow to crash the system or run attacker code.

How to fix it

Upgrade the Linux kernel to a version containing the fix for hid-magicmouse.c. For the listed Ubuntu packages apply the following fixed versions: webkitgtk (Ubuntu:14.04:LTS) 2.4.8-1ubuntu1~ubuntu14.04.1 and webkitgtk (Ubuntu:16.04:LTS) 2.4.9-2ubuntu2.

How to confirm the fix worked

Verify the installed kernel or package version matches or exceeds the listed fixed versions and confirm the magicmouse_raw_event function no longer accepts unbounded data.

Typical attack path

1. Obtain or fabricate a USB device that emulates a Magic Mouse
2. Connect the device to a vulnerable Linux system
3. Send large volumes of EHCI or XHCI event data
4. Trigger the overflow in magicmouse_raw_event to achieve crash or code execution

How to detect it

Review system logs for unexpected crashes in the HID subsystem around the time of USB device connections; examine dmesg or kernel logs for stack overflow or magicmouse-related faults.

What your security team should do

• Apply the kernel or package updates immediately on all affected systems
• Disable the magicmouse HID driver if the hardware is not required
• Restrict physical USB access where feasible