CVE-2015-7515: Null Pointer Dereference
An out-of-bounds memory access flaw was found in aiptek USB tablet driver in aiptekprobe() function in drivers/input/tablet/aiptek.c. The driver assumes that the interface always has at least one endpoint. By using a specially crafted USB device with no endpoints on one of its interfaces an unprivileged user with a physical access to the system can trigger a kernel NULL pointer dereference causing the system to panic.
Acknowledgements:
Red Hat would like to thank Ralf Spenneberg of OpenSource Security for reporting this issue.
References:
Proposed upstream patch: http://www.spinics.net/lists/linux-input/msg42294.html
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8e20cf2bce122ce9262d6034ee5d5b76fbb92f96
Other sources
The aiptekprobe function in drivers/input/tablet/aiptek.c in the Linux kernel before 4.4 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 3.13.0-86.130 - Upgrade
Upgrade
ubuntu/linux-lts-utopicto a version that resolves this vulnerability.Fixed in 3.16.0-71.91~14.04.1 - Upgrade
Upgrade
ubuntu/linux-lts-vividto a version that resolves this vulnerability.Fixed in 3.19.0-59.65~14.04.1 - Upgrade
Upgrade
ubuntu/linux-lts-wilyto a version that resolves this vulnerability.Fixed in 4.2.0-36.41~14.04.1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 4.4
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2015-7515.
What is the severity of CVE-2015-7515?
The severity of CVE-2015-7515 is low.
How does CVE-2015-7515 affect the Linux kernel?
CVE-2015-7515 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted USB device that lacks endpoints.
Which versions of the Linux kernel are affected by CVE-2015-7515?
The Linux kernel versions before 4.4 are affected by CVE-2015-7515.
Is there a fix available for CVE-2015-7515?
Yes, the fix for CVE-2015-7515 is available in Linux kernel version 4.4 and above.