CVE-2015-7566: Null Pointer Dereference
A local kernel crash on invalid USB device requiring the visor driver was reported. The clie5attach function of the visor driver, which is called during the driver initialization process, expects an OUT-Bulk-Endpoint. Due to an incomplete sanity check, the visor driver tries to dereference null-pointers, which results in crash.
Vulnerable code:
CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c) ... 607 608 pipe = usbsndbulkpipe(serial->dev, port->bulkoutendpointAddress); 609 for (j = 0; j < ARRAYSIZE(port->writeurbs); ++j) 610 port->writeurbs[j]->pipe = pipe; / if there is no configured OUT-bulk-endpoint, the kernel tries to dereference null-pointers / 611 612 return 0; 613 } ...
Reproducer can be found in original bug report: https://bugzilla.redhat.com/showbug.cgi?id=1283371
Proposed upstream patch: http://marc.info/?l=linux-usb&m=145260786729359&w=2
Upstream commit: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c
Bugtraq: http://seclists.org/bugtraq/2016/Mar/58
Other sources
The clie5attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2015-7566?
CVE-2015-7566 is a vulnerability in the Linux kernel that allows physically proximate attackers to cause a denial of service or possibly have other unspecified impacts.
What is the severity level of CVE-2015-7566?
The severity level of CVE-2015-7566 is low.
How does CVE-2015-7566 affect the Linux kernel?
CVE-2015-7566 affects the clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through version 4.4.1.
How can an attacker exploit CVE-2015-7566?
An attacker can exploit CVE-2015-7566 by inserting a USB device that lacks a bulk-out endpoint, causing a NULL pointer dereference and system crash.
What is the fix for CVE-2015-7566?
The fix for CVE-2015-7566 is to update the Linux kernel to version 4.5 or higher.