CVE-2017-16912

Published: Jan 31, 2018Modified: Nov 21, 2024

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet.

Affected (4)

Products: Linux: Linux Kernel

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 4.1.0 to 4.1.49
Linux Linux Kernel	From 4.14.0 to 4.14.8
Linux Linux Kernel	From 4.4.0 to 4.4.107
Linux Linux Kernel	From 4.9.0 to 4.9.71

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (26)

http://www.securityfocus.com/bid/102150

Source: PSIRT-CNA@flexerasoftware.com

Third Party AdvisoryVDB Entry

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8

Source: PSIRT-CNA@flexerasoftware.com

Issue Tracking

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.114

Source: PSIRT-CNA@flexerasoftware.com

Issue Tracking

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.71

Source: PSIRT-CNA@flexerasoftware.com

Issue Tracking

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/drivers/usb/usbip?id=635f545a7e8be7596b9b2b6a43cab6bbd5a88e43

Source: PSIRT-CNA@flexerasoftware.com

Issue TrackingPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html

Source: PSIRT-CNA@flexerasoftware.com

https://secuniaresearch.flexerasoftware.com/advisories/77000/

Source: PSIRT-CNA@flexerasoftware.com

Third Party Advisory

https://secuniaresearch.flexerasoftware.com/secunia_research/2017-21/

Source: PSIRT-CNA@flexerasoftware.com

Third Party Advisory

https://usn.ubuntu.com/3619-1/

Source: PSIRT-CNA@flexerasoftware.com

https://usn.ubuntu.com/3619-2/

Source: PSIRT-CNA@flexerasoftware.com

https://usn.ubuntu.com/3754-1/

Source: PSIRT-CNA@flexerasoftware.com

https://www.debian.org/security/2018/dsa-4187

Source: PSIRT-CNA@flexerasoftware.com

https://www.spinics.net/lists/linux-usb/msg163480.html

Source: PSIRT-CNA@flexerasoftware.com

Issue TrackingThird Party Advisory

http://www.securityfocus.com/bid/102150

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.114

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.71

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/drivers/usb/usbip?id=635f545a7e8be7596b9b2b6a43cab6bbd5a88e43

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://secuniaresearch.flexerasoftware.com/advisories/77000/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://secuniaresearch.flexerasoftware.com/secunia_research/2017-21/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/3619-1/

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/3619-2/

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/3754-1/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2018/dsa-4187

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.spinics.net/lists/linux-usb/msg163480.html

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.