PT-2017-3153 · Linux+2 · Linux Kernel+2

Andrey Konovalov · Publicado 2017-10-11 · Atualizado 2024-07-17 · CVE-2017-16532

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.13.11

Description The issue is related to the get endpoints function in drivers/usb/misc/usbtest.c, which can cause a denial of service due to a NULL pointer dereference and system crash when a crafted USB device is used. This could potentially have other unspecified impacts. The issue can be exploited by local users.

Recommendations For Linux kernel versions through 4.13.11, update to a version later than 4.13.11 to resolve the issue. As a temporary workaround, consider restricting the use of USB devices to minimize the risk of exploitation.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2017-2604

ALT-PU-2018-1991

BDU:2017-02565

CVE-2017-16532

DLA-1200-1

USN-3617-1

USN-3617-2

USN-3617-3

USN-3619-1

USN-3619-2

USN-3754-1

Produtos afetados

Alt Linux

Linux Kernel

Ubuntu

Referências · 126

• https://github.com/torvalds/linux/commit/7c80f9e4a588f1925b07134bb2e3689335f6c6d8 · Correção
• https://ubuntu.com/security/notices/USN-3617-2 · Aviso do Fabricante
• https://groups.google.com/d/msg/syzkaller/l3870gs3LhA/y79DYQdFBAAJ · Nota
• https://ubuntu.com/security/CVE-2018-13094 · Aviso do Fabricante
• https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.47 · Nota
• https://ubuntu.com/security/CVE-2017-16538 · Aviso do Fabricante
• https://usn.ubuntu.com/usn/usn-3619-1 · Nota
• https://ubuntu.com/security/CVE-2017-15129 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16536 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3754-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-10877 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16537 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-0861 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-16535 · Aviso do Fabricante
• https://usn.ubuntu.com/3619-2 · Aviso do Fabricante