PT-2017-1921 · Linux+1 · Linux Kernel+1

Published 2017-01-31 · Updated 2017-04-28 · CVE-2017-8071

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.9.x before 4.9.9

Description The issue arises from the use of a spinlock in the drivers/hid/hid-cp2112.c module without considering the possibility of sleeping in a USB HID request callback. This allows local users to cause a denial of service (deadlock) via unspecified vectors. The vulnerability is due to incorrect handling or release of resources.

Recommendations For Linux kernel versions 4.9.x before 4.9.9, update to version 4.9.9 or later to resolve the issue. As a temporary workaround, consider disabling the use of the hid-cp2112 driver until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the hid-cp2112 module in the affected USB HID request callback until the issue is resolved.

Fix

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALT-PU-2017-1127

ALT-PU-2017-1152

BDU:2017-01081

CVE-2017-8071

Affected Products

Alt Linux

Linux Kernel

References · 15

• https://github.com/torvalds/linux/commit/7a7b5df84b6b4e5d599c7289526eed96541a0654 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8071 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-8071 · Vendor Advisory
• http://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-8071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8071 · Security Note
• https://bdu.fstec.ru/vul/2017-01081 · Security Note
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7a7b5df84b6b4e5d599c7289526eed96541a0654 · Patch
• http://openwall.com/lists/oss-security/2017/04/16/4 · Patch
• https://osv.dev/vulnerability/CVE-2017-8071 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-8071 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-8071 · Security Note
• http://securityfocus.com/bid/97991 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8071 · Note
• https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.9 · Note