CVE-2016-3137: Null Pointer Dereference
A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required cypressm8 driver. The kernel would panic causing null pointer dereference.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283368
Other sources
drivers/usb/serial/cypressm8.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypressgenericportprobe and cypressopen functions.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3137?
CVE-2016-3137 is classified as a high severity vulnerability due to its potential to cause a kernel panic.
How do I fix CVE-2016-3137?
To fix CVE-2016-3137, you should upgrade to a kernel version that is 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
Which operating systems are affected by CVE-2016-3137?
CVE-2016-3137 affects SUSE Linux Enterprise products, older versions of Ubuntu, and various distributions using vulnerable Linux kernel versions.
What causes CVE-2016-3137?
CVE-2016-3137 is caused by a flaw in the Linux kernel's USB device management code that leads to a null pointer dereference.
What is the impact of CVE-2016-3137?
The impact of CVE-2016-3137 includes potential system crashes and instability for users utilizing devices requiring the cypress_m8 driver.