CVE-2016-2188: Null Pointer Dereference
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required iowarrior driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283390
Other sources
The iowarriorprobe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2188?
CVE-2016-2188 is classified as a medium severity vulnerability that can cause a kernel panic leading to system crashes.
How do I fix CVE-2016-2188?
To fix CVE-2016-2188, upgrade your Linux kernel to at least version 5.10.223-1 or apply the necessary patches from your distribution.
Which systems are affected by CVE-2016-2188?
CVE-2016-2188 affects various SUSE Linux Enterprise versions and specific versions of the Linux kernel, with a range of distributions such as Ubuntu.
What types of attacks can exploit CVE-2016-2188?
CVE-2016-2188 may be exploited through the connection of USB devices requiring the iowarrior driver, causing a null pointer dereference.
Is CVE-2016-2188 specific to USB devices?
Yes, CVE-2016-2188 specifically affects the USB device management code in the Linux kernel, leading to potential crashes when certain USB devices are connected.