Kernel memory leak in the CUSE driver using stress-ng was found. It is possible for privileged attacker to cause a local DoS via memory exhaustion by repeatedly opening /dev/cuse for reading.
Upstream patch:
https://git.kernel.org/linus/2c5816b4beccc8ba709144539f6fdd764f8fa49c
References:
https://bugzilla.novell.com/showbug.cgi?id=969356
http://seclists.org/oss-sec/2016/q1/495
A local kernel crash on invalid USB device requiring the visor driver was reported. The clie5attach function of the visor driver, which is called during the driver initialization process, expects an OUT-Bulk-Endpoint. Due to an incomplete sanity check, the visor driver tries to dereference null-pointers, which results in crash.
Vulnerable code:
CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c) ... 607 608 pipe = usbsndbulkpipe(serial->dev, port->bulkoutendpointAddress); 609 for (j = 0; j < ARRAYSIZE(port->writeurbs); ++j) 610 port->writeurbs[j]->pipe = pipe; / if there is no configured OUT-bulk-endpoint, the kernel tries to dereference null-pointers / 611 612 return 0; 613 } ...
Reproducer can be found in original bug report: https://bugzilla.redhat.com/showbug.cgi?id=1283371
Proposed upstream patch: http://marc.info/?l=linux-usb&m=145260786729359&w=2
Upstream commit: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c
Bugtraq: http://seclists.org/bugtraq/2016/Mar/58