CVE-2015-7515: Null Pointer Dereference
An out-of-bounds memory access flaw was found in aiptek USB tablet driver in aiptekprobe() function in drivers/input/tablet/aiptek.c. The driver assumes that the interface always has at least one endpoint. By using a specially crafted USB device with no endpoints on one of its interfaces an unprivileged user with a physical access to the system can trigger a kernel NULL pointer dereference causing the system to panic.
Acknowledgements:
Red Hat would like to thank Ralf Spenneberg of OpenSource Security for reporting this issue.
References:
Proposed upstream patch: http://www.spinics.net/lists/linux-input/msg42294.html
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8e20cf2bce122ce9262d6034ee5d5b76fbb92f96
Other sources
The aiptekprobe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2015-7515.
What is the severity of CVE-2015-7515?
The severity of CVE-2015-7515 is low.
How does CVE-2015-7515 affect the Linux kernel?
CVE-2015-7515 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.
Which versions of the Linux kernel are affected by CVE-2015-7515?
The Linux kernel versions before 4.4 are affected by CVE-2015-7515.
Is there a fix available for CVE-2015-7515?
Yes, the fix for CVE-2015-7515 is available in Linux kernel version 4.4 and above.