Red Hat Bugzilla – Bug 1316995
CVE-2016-3140 kernel: Crash on invalid USB device descriptors (digi_acceleport driver)
Last modified: 2016-05-16 09:55:33 EDT
Kernel crash occurs when presented a buggy USB device which requires digi_acceleport driver, causing null pointer dereference. Product bug: https://bugzilla.redhat.com/show_bug.cgi?id=1283378
Acknowledgments: Name: Ralf Spenneberg (OpenSource Security)
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1317010]
Public via: http://seclists.org/bugtraq/2016/Mar/61 CVE request and assignment: http://seclists.org/oss-sec/2016/q1/607 http://seclists.org/oss-sec/2016/q1/624
Patch sent upstream: http://marc.info/?l=linux-usb&m=145796765030590&w=2 http://www.spinics.net/lists/linux-usb/msg137698.html Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5a07975ad0a36708c6b0a5b9fea1ff811d0b0c1f
Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and MRG-2. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
kernel-4.5.0-302.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
kernel-4.4.6-301.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
kernel-4.4.6-201.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.