PT-2017-3147 · Linux+3 · Linux Kernel+3

Andrey Konovalov · Published 2017-11-02 · Updated 2018-08-24 · CVE-2017-16538

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.13.11

Description The issue is related to a missing warm-start check and incorrect attach timing in the Linux kernel, specifically in the drivers/media/usb/dvb-usb-v2/lmedm04.c file. This can be exploited by a local user via a crafted USB device, potentially causing a denial of service, such as a general protection fault and system crash, or possibly having other unspecified impacts. The vulnerability is associated with the functions dm04 lme2510 frontend attach and dm04 lme2510 tuner.

Recommendations For Linux kernel versions through 4.13.11, consider disabling the use of USB devices that could exploit this issue until a patch is available. As a temporary workaround, restrict access to the affected driver file lmedm04.c to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2017-2604

ALT-PU-2018-1991

BDU:2017-02559

CVE-2017-16538

DSA-4073-1

DSA-4082-1

SUSE-SU-2018:0011-1

SUSE-SU-2018:0031-1

SUSE-SU-2018:0040-1

SUSE-SU-2018:0115-1

SUSE-SU-2018:0180-1

USN-3631-1

USN-3631-2

USN-3754-1

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 204

• https://osv.dev/vulnerability/SUSE-SU-2018:0040-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16644 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15649 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16527 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18270 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16526 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7566 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13406 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11473 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16531 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3631-1 · Vendor Advisory
• https://usn.ubuntu.com/3631-2 · Vendor Advisory
• https://usn.ubuntu.com/3754-1 · Vendor Advisory