PT-2014-5125 · Linux+5 · Linux Kernel+5
James Forshaw
·
Publicado
2014-09-09
·
Atualizado
2024-03-14
·
CVE-2014-3185
CVSS v2.0
6.9
Média
| Vetor | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 3.16.2
Description
The issue concerns multiple buffer overflows in the
command port read callback function in drivers/usb/serial/whiteheat.c within the Whiteheat USB Serial Driver. This allows physically proximate attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and system crash. The attack can be carried out via a crafted device that provides a large amount of data associated with a bulk response, specifically through (1) EHCI or (2) XHCI.Recommendations
For Linux kernel versions prior to 3.16.2, update to version 3.16.2 or later to resolve the issue. As a temporary workaround, consider restricting access to USB devices or disabling the
command port read callback function in the Whiteheat USB Serial Driver until a patch is applied. Additionally, avoid using crafted devices that could exploit this vulnerability.Exploit
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu