CVE-2006-2936
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the hardware can handle, which…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The ftdi_sio driver (usb/serial/ftdi_sio.c) in Linux kernel 2.6.x up to 2.6.17, and possibly later versions, allows local users to cause a denial of service (memory consumption) by writing more data to the serial port than the hardware can handle, which causes the data to be queued.
- CVSS 2.0
- 7.8 HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
- EPSS
- 2.96% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- linux/linux kernel
- Source
- secalert@redhat.com
References
- http://secunia.com/advisories/20703Vendor Advisory
- http://secunia.com/advisories/21057Vendor Advisory
- http://secunia.com/advisories/21298Vendor Advisory
- http://secunia.com/advisories/21605Vendor Advisory
- http://secunia.com/advisories/21614Vendor Advisory
- http://secunia.com/advisories/21934Vendor Advisory
- http://secunia.com/advisories/22093Vendor Advisory
- http://secunia.com/advisories/22174Vendor Advisory
- http://secunia.com/advisories/24547Vendor Advisory
- http://secunia.com/advisories/25226Vendor Advisory
- http://secunia.com/advisories/25683Vendor Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-203.htm
- http://www.debian.org/security/2006/dsa-1184
- http://www.kernel.org/git/?p=linux/kernel/git/gregkh/patches.git%3Ba=blob%3Bh=4b4d9cfea17618b80d3ac785b701faeaf60141f1%3Bhb=396eb2aac550ec55856c6843ef9017e800c3d656
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:150
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:151
- http://www.novell.com/linux/security/advisories/2007_18_kernel.html
- http://www.novell.com/linux/security/advisories/2007_21_kernel.html
- http://www.novell.com/linux/security/advisories/2007_30_kernel.html
- http://www.novell.com/linux/security/advisories/2007_35_kernel.html
- http://www.osvdb.org/27119
- http://www.redhat.com/support/errata/RHSA-2006-0617.html
- http://www.securityfocus.com/archive/1/440300/100/0/threaded
- http://www.securityfocus.com/bid/19033
- http://www.ubuntu.com/usn/usn-331-1
- http://www.ubuntu.com/usn/usn-346-1
- http://www.vupen.com/english/advisories/2006/2841Vendor Advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=197610
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27807
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10265
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.