CVE-2017-17558
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows…
Does this matter?
Lower severity and a low EPSS score (0.48%). Track it; it rarely justifies an emergency change on its own.
Description
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.
- CVSS 3.0
- 6.6 MEDIUMCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.48% probability · 40th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- linux/linux kernel · suse/linux enterprise server
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlThird Party Advisory
- http://openwall.com/lists/oss-security/2017/12/12/7Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0676
- https://access.redhat.com/errata/RHSA-2018:1062
- https://access.redhat.com/errata/RHSA-2019:1170
- https://access.redhat.com/errata/RHSA-2019:1190
- https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
- https://www.debian.org/security/2017/dsa-4073Third Party Advisory
- https://www.debian.org/security/2018/dsa-4082
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.spinics.net/lists/linux-usb/msg163644.htmlIssue Tracking, Patch
- http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.htmlThird Party Advisory
- http://openwall.com/lists/oss-security/2017/12/12/7Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0676
- https://access.redhat.com/errata/RHSA-2018:1062
- https://access.redhat.com/errata/RHSA-2019:1170
- https://access.redhat.com/errata/RHSA-2019:1190
- https://lists.debian.org/debian-lts-announce/2018/01/msg00004.html
- https://usn.ubuntu.com/3619-1/
- https://usn.ubuntu.com/3619-2/
- https://usn.ubuntu.com/3754-1/
- https://www.debian.org/security/2017/dsa-4073Third Party Advisory
- https://www.debian.org/security/2018/dsa-4082
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.spinics.net/lists/linux-usb/msg163644.htmlIssue Tracking, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.