CVE-2016-2782: Null Pointer Dereference
A local kernel crash on invalid USB device requiring the visor driver was reported. The treoattach() function of the [visor] driver, which is called during the driver initialization process, was dereferencing the bulk-in and interrupt-in urbs without first making sure they had been allocated by core. Due to an incomplete sanity check, the visor driver tries to dereference null-pointers, which results in crash.
Vulnerable code:
CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c) ... 554 #define COPYPORT(dest, src) \ 555 do { \ 556 int i; \ 557 \ 558 for (i = 0; i < ARRAYSIZE(src->readurbs); ++i) { \ 559 dest->readurbs[i] = src->readurbs[i]; \ / Possible Nullpointer-Dereference / 560 dest->readurbs[i]->context = dest; \ 561 dest->bulkinbuffers[i] = src->bulkinbuffers[i]; \ 562 } \ 563 dest->readurb = src->readurb; \ 564 dest->bulkinendpointAddress = src->bulkinendpointAddress;\ 565 dest->bulkinbuffer = src->bulkinbuffer; \ 566 dest->bulkinsize = src->bulkinsize; \ 567 dest->interruptinurb = src->interruptinurb; \ 568 dest->interruptinurb->context = dest; \ 569 dest->interruptinendpointAddress = \ 570 src->interruptinendpointAddress;\ 571 dest->interruptinbuffer = src->interruptinbuffer; \ 572 } while (0); 573 574 swapport = kmalloc(sizeof(swapport), GFPKERNEL); 575 if (!swapport) 576 return -ENOMEM; 577 COPYPORT(swapport, serial->port[0]); / no sanity-check! / 578 COPYPORT(serial->port[0], serial->port[1]); / no sanity-check! / 579 COPYPORT(serial->port[1], swapport); / no sanity-check! / ...
Reproducer can be found in original bug report: https://bugzilla.redhat.com/showbug.cgi?id=1283374
An upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c
Public via: http://seclists.org/bugtraq/2016/Mar/86
CVE-ID request and assignment: http://seclists.org/oss-sec/2016/q1/456 http://seclists.org/oss-sec/2016/q1/458
Other sources
The treoattach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-2782?
CVE-2016-2782 is a vulnerability in the Linux kernel before version 4.5 that allows physically proximate attackers to cause a denial of service or possibly have unspecified other impact by inserting a USB device without a bulk-in or interrupt endpoint.
How severe is CVE-2016-2782?
CVE-2016-2782 has a severity level of low.
How can I fix CVE-2016-2782?
To fix CVE-2016-2782, update your Linux kernel to version 4.5 or later.
Are there any exploits available for CVE-2016-2782?
Yes, there is an exploit available for CVE-2016-2782. You can find it at the following link: https://www.exploit-db.com/exploits/39539/
Where can I find more information about CVE-2016-2782?
You can find more information about CVE-2016-2782 at the following links: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html, http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html