CVE-2016-2187: Null Pointer Dereference
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required gtco module. The kernel would panic causing null pointer dereference attempting to access invalid USB device descriptors.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283385
Intended to be public via:
http://seclists.org/bugtraq/2016/Mar/86
Public via:
https://bugzilla.redhat.com/showbug.cgi?id=1283385
Proposed upstream patch (linux-usb@ and linux-input@ lists):
http://www.spinics.net/lists/linux-usb/msg137950.html http://www.spinics.net/lists/linux-input/msg43786.html
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=162f98dea487206d9ab79fc12ed64700667a894d
Other sources
The gtcoprobe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2187?
CVE-2016-2187 has been classified with high severity due to its potential to cause kernel panics and crashes in affected systems.
How do I fix CVE-2016-2187?
To fix CVE-2016-2187, update the Linux kernel to the recommended versions including 5.10.223-1 or later versions.
Which versions of Ubuntu are affected by CVE-2016-2187?
CVE-2016-2187 affects Ubuntu versions 12.04, 14.04, 15.10, and 16.04 LTS.
What Linux distributions are impacted by CVE-2016-2187?
CVE-2016-2187 impacts various Linux distributions including Ubuntu and SUSE Linux versions specified in the vulnerability report.
Is CVE-2016-2187 related to USB device management in Linux?
Yes, CVE-2016-2187 is specifically related to a flaw in the Linux kernel's USB device management code.