CVE-2017-15102: Null Pointer Dereference
Last updated 24 July 2024
Other sources
Race condition in legousbtower driver exposes a null pointer dereference caused by not removing the device file interface on an error when the probe function is called. This can cause a write-what-where condition by remapping dev->interruptoutbuffer in towerwrite, leading to privilege escalation.
Upstream patch:
https://github.com/torvalds/linux/commit/2fae9e5a7babada041e2e161699ade2447a01989
— Red Hat
The towerprobe function in drivers/usb/misc/legousbtower.c in the Linux kernel before 4.8.1 allows local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 3.13.0-142.191 - Upgrade
Upgrade
ubuntu/linux-lts-xenialto a version that resolves this vulnerability.Fixed in 4.4.0-47.68~14.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 4.4.0-47.68 - Upgrade
Upgrade
ubuntu/linux-raspi2to a version that resolves this vulnerability.Fixed in 4.4.0-1038.45 - Upgrade
Upgrade
ubuntu/linux-snapdragonto a version that resolves this vulnerability.Fixed in 4.4.0-1035.39 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 4.8.1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15102?
The severity of CVE-2017-15102 is low.
How does CVE-2017-15102 impact Linux kernel before version 4.8.1?
CVE-2017-15102 allows local users to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference.
Which Linux kernel versions are affected by CVE-2017-15102?
Linux kernel versions before 4.8.1 are affected by CVE-2017-15102.
How can I fix the vulnerability CVE-2017-15102?
To fix CVE-2017-15102, update your Linux kernel to version 4.8.1 or later.
Where can I find more information about CVE-2017-15102?
You can find more information about CVE-2017-15102 in the references: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2fae9e5a7babada041e2e161699ade2447a01989, http://seclists.org/oss-sec/2017/q4/238, https://bugzilla.redhat.com/show_bug.cgi?id=1505905.