CVE-2016-3140: Null Pointer Dereference
Published Mar 11, 2016
·Updated
Kernel crash occurs when presented a buggy USB device which requires digiacceleport driver, causing null pointer dereference.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1283378
Other sources
The digiportinit function in drivers/usb/serial/digiacceleport.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
— Launchpad
Affected Software
20 affected componentsFixes available
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Linux Linux kernel<=4.5.0
Novell Suse Linux Enterprise Software Development Kit=11.0-sp4
Novell Suse Linux Enterprise Software Development Kit=12.0
Novell Suse Linux Enterprise Software Development Kit=12.0-sp1
Novell Suse Linux Enterprise Debuginfo=11.0-sp4
Novell Suse Linux Enterprise Desktop=12.0
Novell Suse Linux Enterprise Desktop=12.0-sp1
Novell Suse Linux Enterprise Live Patching=12.0
Novell Suse Linux Enterprise Module For Public Cloud=12.0
Novell Suse Linux Enterprise Real Time Extension=11.0-sp4
Novell Suse Linux Enterprise Real Time Extension=12.0-sp1
Novell Suse Linux Enterprise Server=11.0-extra
Novell Suse Linux Enterprise Server=11.0-sp4
Novell Suse Linux Enterprise Server=12.0
Novell Suse Linux Enterprise Server=12.0-sp1
Novell Suse Linux Enterprise Workstation Extension=12.0
Novell Suse Linux Enterprise Workstation Extension=12.0-sp1
debian/linux
5.10.223-15.10.234-16.1.129-16.1.135-16.12.22-16.12.25-1
Remediation
Event History
Mar 11, 2016
Data Sourced
via Red Hat·04:35 PM
DescriptionSeverityAffected Software
May 2, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Jan 11, 2024
Data Sourced
via Launchpad·10:17 PM
Description
Sep 16, 2024
Data Sourced
via Ubuntu·01:14 AM
RemedyDescriptionSeverityAffected Software
Apr 28, 2025
Data Sourced
via Debian·03:28 AM
DescriptionAffected Software
Frequently Asked Questions
1
Is there a workaround for CVE-2016-3140?
Currently, there is no known workaround for CVE-2016-3140 other than applying the available updates.