CVE-2017-16538: Input Validation
drivers/media/usb/dvb-usb-v2/lmedm04.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (general protection fault and system crash) or possibly have unspecified other impact via a crafted USB device, related to a missing warm-start check and incorrect attach timing (dm04lme2510frontendattach versus dm04lme2510tuner).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is CVE-2017-16538?
CVE-2017-16538 is a vulnerability in the Linux kernel that allows local users to cause a denial of service or possibly have unspecified other impact via a crafted USB device.
How does CVE-2017-16538 affect the Linux kernel?
CVE-2017-16538 affects the Linux kernel through version 4.13.11.
What is the severity of CVE-2017-16538?
The severity of CVE-2017-16538 is not specified.
How can local users exploit CVE-2017-16538?
Local users can exploit CVE-2017-16538 by using a crafted USB device.
Is there a fix for CVE-2017-16538?
Yes, the Linux kernel version 4.16 and above includes a fix for CVE-2017-16538.