PT-2017-3154 · Linux+3 · Linux Kernel+3

Andrey Konovalov · Published 2017-09-19 · Updated 2024-07-17 · CVE-2017-16531

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.13.6

Description The issue is caused by an out-of-bounds operation in memory within the Linux kernel, specifically in the drivers/usb/core/config.c file. This can be exploited by an attacker using a specially crafted USB device that utilizes the USB DT INTERFACE ASSOCIATION descriptor type, potentially leading to a denial of service or other unspecified impacts.

Recommendations For Linux kernel versions prior to 4.13.6, update to version 4.13.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of USB devices or disabling the config.c functionality in the drivers/usb/core module until a patch is available. Avoid using the USB DT INTERFACE ASSOCIATION descriptor in crafted USB devices to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2017-2425

ALT-PU-2018-1991

BDU:2017-02566

CVE-2017-16531

DLA-1200-1

SUSE-SU-2017:3210-1

SUSE-SU-2017:3249-1

SUSE-SU-2017:3265-1

SUSE-SU-2018:0040-1

SUSE-SU-2018:0180-1

USN-3485-1

USN-3485-2

USN-3485-3

USN-3487-1

USN-3754-1

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 264

• https://github.com/torvalds/linux/commit/bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb · Patch
• https://ubuntu.com/security/CVE-2018-13094 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16536 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3754-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16537 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16535 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16643 · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Patch
• https://ubuntu.com/security/CVE-2018-13405 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7518 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2584 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16529 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10021 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2018-4040.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16525 · Vendor Advisory