CVE-2016-2186: Null Pointer Dereference
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required powermate driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283384
Public via:
http://seclists.org/bugtraq/2016/Mar/85
This was assigned CVE-2016-2186 by Red Hat.
Other sources
The powermateprobe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2186?
CVE-2016-2186 is considered a medium severity vulnerability due to potential kernel crashes.
How do I fix CVE-2016-2186?
To address CVE-2016-2186, update the Linux kernel to a version higher than 4.5.0 or apply the recommended patches.
Which products are affected by CVE-2016-2186?
CVE-2016-2186 affects various versions of the Linux kernel and specific SUSE Linux Enterprise products.
What type of vulnerability is CVE-2016-2186?
CVE-2016-2186 is a vulnerability in the USB device management code within the Linux kernel.
Can CVE-2016-2186 lead to system instability?
Yes, CVE-2016-2186 can cause a kernel panic and lead to system instability when a vulnerable USB device is connected.