CVE-2017-15102: Null Pointer Dereference
Last updated 24 July 2024
Other sources
Race condition in legousbtower driver exposes a null pointer dereference caused by not removing the device file interface on an error when the probe function is called. This can cause a write-what-where condition by remapping dev->interruptoutbuffer in towerwrite, leading to privilege escalation.
Upstream patch:
https://github.com/torvalds/linux/commit/2fae9e5a7babada041e2e161699ade2447a01989
— Red Hat
The towerprobe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15102?
The severity of CVE-2017-15102 is low.
How does CVE-2017-15102 impact Linux kernel before version 4.8.1?
CVE-2017-15102 allows local users to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.
Which Linux kernel versions are affected by CVE-2017-15102?
Linux kernel versions before 4.8.1 are affected by CVE-2017-15102.
How can I fix the vulnerability CVE-2017-15102?
To fix CVE-2017-15102, update your Linux kernel to version 4.8.1 or later.
Where can I find more information about CVE-2017-15102?
You can find more information about CVE-2017-15102 in the references: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2fae9e5a7babada041e2e161699ade2447a01989, http://seclists.org/oss-sec/2017/q4/238, https://bugzilla.redhat.com/show_bug.cgi?id=1505905.