The ims_pcu_get_cdc_union_desc function in drivers/input/misc/ims-pcu.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (ims_pcu_parse_cdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. References: https://groups.google.com/forum/#!msg/syzkaller/q6jjr1OhqO8/WcA99AVFBAAJ http://seclists.org/oss-sec/2017/q4/392 An upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea04efee7635c9120d015dcdeeeb6988130cb67a
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1516274]
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE, as a code with the flaw is not present or is not built in the products listed.