Bug 1531142 (CVE-2017-17975) - CVE-2017-17975 kernel: use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c
Summary: CVE-2017-17975 kernel: use-after-free in the usbtv_probe function in drivers/...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-17975
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1538929
Blocks: 1538932
TreeView+ depends on / blocked
 
Reported: 2018-01-04 16:25 UTC by Laura Pardo
Modified: 2021-03-11 16:49 UTC (History)
47 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A use-after-free fault in the Linux kernel's usbtv driver could allow an attacker to cause a denial of service (system crash), or have unspecified other impacts, by triggering failure of audio registration of USB hardware using the usbtv kernel module.
Clone Of:
Environment:
Last Closed: 2018-02-12 11:11:23 UTC
Embargoed:

Attachments (Terms of Use)

Description Laura Pardo 2018-01-04 16:25:49 UTC 
There is a use-after-free in the usbtv driver, on an error path of the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c in the Linux kernel through 4.14.10. This allows an attacker to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure.
Comment 1 Laura Pardo 2018-01-04 16:53:06 UTC 
References:
http://linuxtesting.org/pipermail/ldv-project/2017-November/001008.html
Comment 3 Adam Mariš 2018-01-26 07:50:40 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1538929]
Comment 5 Wade Mealing 2018-02-07 05:38:57 UTC 
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7, MRG-2 and real time kernels as the code which can trigger the flaw is not present in the products listed.
Comment 7 Justin M. Forbes 2018-05-04 17:05:54 UTC 
This was fixed for Fedora with the 4.15.16 stable updates.
Note You need to log in before you can comment on or make changes to this bug.