CVE-2017-8924: Integer Underflow
Last updated 29 November 2024
Other sources
The edgebulkincallback function in drivers/usb/serial/ioti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an ioti USB serial device) to trigger an integer underflow.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2017-8924?
CVE-2017-8924 is a vulnerability in the Linux kernel that allows local users to obtain sensitive information from uninitialized kernel memory.
How can this vulnerability be exploited?
This vulnerability can be exploited by using a crafted USB device (posing as an io_ti USB serial device) to trigger the edge_bulk_in_callback function in the Linux kernel.
What is the severity of CVE-2017-8924?
The severity of CVE-2017-8924 is high.
Which versions of the Linux kernel are affected by CVE-2017-8924?
The Linux kernel versions before 4.10.4 are affected by CVE-2017-8924.
How can I fix CVE-2017-8924?
To fix CVE-2017-8924, update your Linux kernel to version 4.10.4 or later.