CVE-2017-16530: Medium severity Linux Linux kernel vulnerability

Q: What is the severity of CVE-2017-16530?

CVE-2017-16530 has a severity rating that indicates a denial of service vulnerability that can lead to system crashes.

Q: How do I fix CVE-2017-16530?

To fix CVE-2017-16530, update your Linux kernel to version 4.13.6 or later.

Q: What software is affected by CVE-2017-16530?

CVE-2017-16530 affects several versions of the Linux kernel prior to 4.13.6 and various distributions, including Google Android.

Q: Can CVE-2017-16530 be exploited remotely?

CVE-2017-16530 primarily affects local users and requires physical access to exploit through a crafted USB device.

Q: What are the potential consequences of CVE-2017-16530?

The potential consequences of CVE-2017-16530 include an out-of-bounds read, system crash, and possible unspecified other impacts.

Published Nov 4, 2017

Updated

Last updated 29 November 2024

Other sources

The uas driver in the Linux kernel before 4.13.6 allows local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to drivers/usb/storage/uas-detect.h and drivers/usb/storage/uas.c.

Affected Software

33 affected componentsFixes available

Linux Linux kernel<3.16.50

Linux Linux kernel>=3.17<3.18.75

Linux Linux kernel>=3.19<4.1.46

Linux Linux kernel>=4.2<4.4.92

Linux Linux kernel>=4.5<4.9.55

Linux Linux kernel>=4.10<4.13.6

Linux Linux kernel<=4.13.5

debian/linux

5.10.223-15.10.234-16.1.129-16.1.135-16.12.22-16.12.25-1

Google Android

ubuntu/linux-aws<4.4.0-1003.3

4.4.0-1003.3

ubuntu/linux-lts-xenial<4.4.0-101.124~14.04.1

4.4.0-101.124~14.04.1

ubuntu/linux*

ubuntu/linux<4.4.0-101.124

4.4.0-101.124

ubuntu/linux-aws<4.4.0-1041.50

4.4.0-1041.50

ubuntu/linux-azure<4.13.0-1005.7

4.13.0-1005.7

ubuntu/linux-gcp<4.13.0-1002.5

4.13.0-1002.5

ubuntu/linux-gke<4.4.0-1034.34

4.4.0-1034.34

ubuntu/linux-hwe<4.13.0-32.35~16.04.1

4.13.0-32.35~16.04.1

ubuntu/linux-kvm<4.4.0-1010.15

4.4.0-1010.15

ubuntu/linux-raspi2<4.4.0-1077.85

4.4.0-1077.85

ubuntu/linux-snapdragon<4.4.0-1079.84

4.4.0-1079.84

ubuntu/linux-azure-fde*

ubuntu/linux-gke*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1003.3
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-101.124~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-101.124
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1041.50
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 4.13.0-1005.7
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 4.13.0-1002.5
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 4.4.0-1034.34
Upgrade
Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.
Fixed in 4.13.0-32.35~16.04.1
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1010.15
Upgrade
Upgrade ubuntu/linux-raspi2 to a version that resolves this vulnerability.
Fixed in 4.4.0-1077.85
Upgrade
Upgrade ubuntu/linux-snapdragon to a version that resolves this vulnerability.
Fixed in 4.4.0-1079.84
Upgrade
Upgrade Linux kernel uas driver to a version that resolves this vulnerability.
Fixed in 4.13.6

Event History

Nov 3, 2017

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Nov 4, 2017

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Mar 5, 2018

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-16530?

CVE-2017-16530 has a severity rating that indicates a denial of service vulnerability that can lead to system crashes.

How do I fix CVE-2017-16530?

To fix CVE-2017-16530, update your Linux kernel to version 4.13.6 or later.

What software is affected by CVE-2017-16530?

CVE-2017-16530 affects several versions of the Linux kernel prior to 4.13.6 and various distributions, including Google Android.

Can CVE-2017-16530 be exploited remotely?

CVE-2017-16530 primarily affects local users and requires physical access to exploit through a crafted USB device.

What are the potential consequences of CVE-2017-16530?

The potential consequences of CVE-2017-16530 include an out-of-bounds read, system crash, and possible unspecified other impacts.

CVE-2017-16530: Medium severity Linux Linux kernel vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2017-16530?

How do I fix CVE-2017-16530?

What software is affected by CVE-2017-16530?

Can CVE-2017-16530 be exploited remotely?

What are the potential consequences of CVE-2017-16530?

Company

Resources

Contact