Bug 1541883 (CVE-2017-16912) - CVE-2017-16912 kernel: Out-of-bounds read in usbip/stub_rx.c:get_pipe() allows attackers to cause a denial of service via crafted USB over IP packet
Summary: CVE-2017-16912 kernel: Out-of-bounds read in usbip/stub_rx.c:get_pipe() allow...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-16912
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1545617
Blocks: 1541886
TreeView+ depends on / blocked
 
Reported: 2018-02-05 06:41 UTC by Sam Fowler
Modified: 2021-03-11 17:06 UTC (History)
27 users (show)

Fixed In Version: kernel 4.4.114, kernel 4.9.71, kernel 4.14.8
Doc Type: Bug Fix
Doc Text:
An out-of-bounds read in drivers/usb/usbip/stub_rx.c:get_pipe() of the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 allows attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet.
Clone Of:
Environment:
Last Closed: 2018-02-15 11:17:10 UTC
Embargoed:

Attachments (Terms of Use)

Description Sam Fowler 2018-02-05 06:41:06 UTC 
An out-of-bounds read in drivers/usb/usbip/stub_rx.c:get_pipe() of the Linux Kernel can allow attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet.

References:

https://secuniaresearch.flexerasoftware.com/secunia_research/2017-21/

https://www.spinics.net/lists/linux-usb/msg163481.html

An upstream Commit:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=635f545a7e8be7596b9b2b6a43cab6bbd5a88e43
Comment 2 Vladis Dronov 2018-02-15 11:07:18 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1545617]
Comment 4 Vladis Dronov 2018-02-15 11:17:10 UTC 
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and 7, its real-time kernel, Red Hat Enterprise MRG 2, Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE, as the code with the flaw is not enabled and is not built in the products listed.
Comment 5 Justin M. Forbes 2018-02-15 13:10:39 UTC 
This was fixed for Fedora with the 4.14.8 stable updates.
Note You need to log in before you can comment on or make changes to this bug.