PT-2017-3153 · Linux+2 · Linux Kernel+2

Andrey Konovalov · Published 2017-10-11 · Updated 2024-07-17 · CVE-2017-16532

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.13.11

Description The issue is related to the get endpoints function in drivers/usb/misc/usbtest.c, which can cause a denial of service due to a NULL pointer dereference and system crash when a crafted USB device is used. This could potentially have other unspecified impacts. The issue can be exploited by local users.

Recommendations For Linux kernel versions through 4.13.11, update to a version later than 4.13.11 to resolve the issue. As a temporary workaround, consider restricting the use of USB devices to minimize the risk of exploitation.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2017-2604

ALT-PU-2018-1991

BDU:2017-02565

CVE-2017-16532

DLA-1200-1

USN-3617-1

USN-3617-2

USN-3617-3

USN-3619-1

USN-3619-2

USN-3754-1

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 126

• https://github.com/torvalds/linux/commit/7c80f9e4a588f1925b07134bb2e3689335f6c6d8 · Patch
• https://ubuntu.com/security/notices/USN-3617-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13094 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16538 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15129 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16536 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3754-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10877 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16537 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-0861 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16535 · Vendor Advisory
• https://usn.ubuntu.com/3619-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16912 · Vendor Advisory
• https://usn.ubuntu.com/3617-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11472 · Vendor Advisory