CVE-2017-16911
The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses.
Does this matter?
Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.
Description
The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
- CVSS 3.0
- 4.7 MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.39% probability · 33th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- linux/linux kernel
- Source
- PSIRT-CNA@flexerasoftware.com
EPSS 0.4% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.securityfocus.com/bid/102156Third Party Advisory, VDB Entry
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8Issue Tracking
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.114Issue Tracking
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/drivers/usb/usbip?id=2f2d0088eb93db5c649d2a5e34a3800a8a935fc5Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html
- https://secuniaresearch.flexerasoftware.com/advisories/80454/Third Party Advisory
- https://secuniaresearch.flexerasoftware.com/secunia_research/2017-20/Third Party Advisory
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
- https://www.debian.org/security/2018/dsa-4187
- https://www.spinics.net/lists/linux-usb/msg163480.htmlIssue Tracking, Mailing List
- http://www.securityfocus.com/bid/102156Third Party Advisory, VDB Entry
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8Issue Tracking
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.114Issue Tracking
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/drivers/usb/usbip?id=2f2d0088eb93db5c649d2a5e34a3800a8a935fc5Patch, Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html
- https://secuniaresearch.flexerasoftware.com/advisories/80454/Third Party Advisory
- https://secuniaresearch.flexerasoftware.com/secunia_research/2017-20/Third Party Advisory
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
- https://www.debian.org/security/2018/dsa-4187
- https://www.spinics.net/lists/linux-usb/msg163480.htmlIssue Tracking, Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.