Last updated 24 July 2024

A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required iowarrior driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1283390

A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required gtco module. The kernel would panic causing null pointer dereference attempting to access invalid USB device descriptors.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1283385

Intended to be public via:

http://seclists.org/bugtraq/2016/Mar/86

Public via:

https://bugzilla.redhat.com/showbug.cgi?id=1283385

Proposed upstream patch (linux-usb@ and linux-input@ lists):

http://www.spinics.net/lists/linux-usb/msg137950.html http://www.spinics.net/lists/linux-input/msg43786.html

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=162f98dea487206d9ab79fc12ed64700667a894d

A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required powermate driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.

Product bug:

https://bugzilla.redhat.com/showbug.cgi?id=1283384

Public via:

http://seclists.org/bugtraq/2016/Mar/85

This was assigned CVE-2016-2186 by Red Hat.

A flaw was found in in the Linux kernel's USB device management code which could cause a kernel panic when a device which required atiremote2 kernel module. The kernel would panic causing null pointer dereference attempting to access a non existent interface descriptor. The atiremote2 driver assumes that there will be at least two interface-descriptors with associated endpoint-descriptors.

Product bugs:

https://bugzilla.redhat.com/showbug.cgi?id=1283362 https://bugzilla.redhat.com/showbug.cgi?id=1283363

Public via:

http://seclists.org/bugtraq/2016/Mar/90

Red Hat assigned CVE-2016-2185 to this issue.

Upstream patch:

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=950336ba3e4a1ffd2ca60d29f6ef386dd2c7351d

A flaw was found in in the Linux kernel's USB device management code which could cause a crash when a device which required sndusbaudio driver. The kernel would panic causing null pointer dereference attempting to access non existent endpoints.

Product bugs:

https://bugzilla.redhat.com/showbug.cgi?id=1283355 https://bugzilla.redhat.com/showbug.cgi?id=1283358

Kernel crash occurs when presented a buggy USB device which requires wacom driver, causing null pointer dereference.

Product bugs:

https://bugzilla.redhat.com/showbug.cgi?id=1283375 https://bugzilla.redhat.com/showbug.cgi?id=1283377

Kernel memory leak in the CUSE driver using stress-ng was found. It is possible for privileged attacker to cause a local DoS via memory exhaustion by repeatedly opening /dev/cuse for reading.

Upstream patch:

https://git.kernel.org/linus/2c5816b4beccc8ba709144539f6fdd764f8fa49c

References:

https://bugzilla.novell.com/showbug.cgi?id=969356

http://seclists.org/oss-sec/2016/q1/495

fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes.

A local kernel crash on invalid USB device requiring the visor driver was reported. The clie5attach function of the visor driver, which is called during the driver initialization process, expects an OUT-Bulk-Endpoint. Due to an incomplete sanity check, the visor driver tries to dereference null-pointers, which results in crash.

Vulnerable code:

CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c) ... 607 608 pipe = usbsndbulkpipe(serial->dev, port->bulkoutendpointAddress); 609 for (j = 0; j < ARRAYSIZE(port->writeurbs); ++j) 610 port->writeurbs[j]->pipe = pipe; / if there is no configured OUT-bulk-endpoint, the kernel tries to dereference null-pointers / 611 612 return 0; 613 } ...

Reproducer can be found in original bug report: https://bugzilla.redhat.com/showbug.cgi?id=1283371

Proposed upstream patch: http://marc.info/?l=linux-usb&m=145260786729359&w=2

Upstream commit: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c

Bugtraq: http://seclists.org/bugtraq/2016/Mar/58