CVE-2017-16529: Medium severity Linux Linux kernel vulnerability

Q: What is the severity of CVE-2017-16529?

CVE-2017-16529 has been identified as a potential denial of service vulnerability that can lead to a system crash.

Q: How do I fix CVE-2017-16529?

To mitigate CVE-2017-16529, update the Linux kernel to a version 4.13.6 or later.

Q: Which versions of the Linux kernel are affected by CVE-2017-16529?

CVE-2017-16529 affects Linux kernel versions prior to 4.13.6, including several older versions in the 3.x and early 4.x series.

Q: Can CVE-2017-16529 be exploited remotely?

CVE-2017-16529 is primarily a local vulnerability requiring access to a system to exploit.

Q: What are the potential impacts of CVE-2017-16529?

The main impact of CVE-2017-16529 is an out-of-bounds read leading to a denial of service and system instability.

Published Nov 4, 2017

Updated

Last updated 29 November 2024

Other sources

The sndusbcreatestreams function in sound/usb/card.c in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device.

Affected Software

37 affected componentsFixes available

Linux Linux kernel<=4.13.5

Linux Linux kernel<3.2.95

Linux Linux kernel>=3.3<3.16.50

Linux Linux kernel>=3.17<3.18.75

Linux Linux kernel>=3.19<4.1.46

Linux Linux kernel>=4.2<4.4.92

Linux Linux kernel>=4.5<4.9.55

Linux Linux kernel>=4.10<4.13.6

Canonical Ubuntu Linux=14.04

Debian Debian Linux=7.0

debian/linux

5.10.223-15.10.234-16.1.129-16.1.133-16.12.21-16.12.22-1

Google Android

ubuntu/linux<3.13.0-157.207

3.13.0-157.207

ubuntu/linux-aws<4.4.0-1003.3

4.4.0-1003.3

ubuntu/linux-lts-xenial<4.4.0-101.124~14.04.1

4.4.0-101.124~14.04.1

ubuntu/linux<4.4.0-101.124

4.4.0-101.124

ubuntu/linux-aws<4.4.0-1041.50

4.4.0-1041.50

ubuntu/linux-azure<4.13.0-1005.7

4.13.0-1005.7

ubuntu/linux-gcp<4.13.0-1002.5

4.13.0-1002.5

ubuntu/linux-gke<4.4.0-1034.34

4.4.0-1034.34

ubuntu/linux-hwe<4.13.0-32.35~16.04.1

4.13.0-32.35~16.04.1

ubuntu/linux-kvm<4.4.0-1010.15

4.4.0-1010.15

ubuntu/linux-raspi2<4.4.0-1077.85

4.4.0-1077.85

ubuntu/linux-snapdragon<4.4.0-1079.84

4.4.0-1079.84

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gke*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.21-1Fixed in 6.12.22-1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 3.13.0-157.207
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1003.3
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-101.124~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-101.124
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1041.50
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.13.0-1005.7
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.13.0-1002.5
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 4.4.0-1034.34
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.13.0-32.35~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1010.15
Upgrade
Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.
Fixed in 4.4.0-1077.85
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.4.0-1079.84
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Fixed in 4.13.6

Event History

Nov 3, 2017

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Nov 4, 2017

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Mar 5, 2018

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-16529?

CVE-2017-16529 has been identified as a potential denial of service vulnerability that can lead to a system crash.

How do I fix CVE-2017-16529?

To mitigate CVE-2017-16529, update the Linux kernel to a version 4.13.6 or later.

Which versions of the Linux kernel are affected by CVE-2017-16529?

CVE-2017-16529 affects Linux kernel versions prior to 4.13.6, including several older versions in the 3.x and early 4.x series.

Can CVE-2017-16529 be exploited remotely?

CVE-2017-16529 is primarily a local vulnerability requiring access to a system to exploit.

What are the potential impacts of CVE-2017-16529?

The main impact of CVE-2017-16529 is an out-of-bounds read leading to a denial of service and system instability.

CVE-2017-16529: Medium severity Linux Linux kernel vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2017-16529?

How do I fix CVE-2017-16529?

Which versions of the Linux kernel are affected by CVE-2017-16529?

Can CVE-2017-16529 be exploited remotely?

What are the potential impacts of CVE-2017-16529?

Company

Resources

Contact