CVE-2016-3138
Ubuntu Security Notice USN-2997-1
Severity Score
4.6
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.
La función acm_probe en drivers/usb/class/cdc-acm.c en el kernel de Linux en versiones anteriores a 4.5.1 permite a atacantes físicamente próximos provocar una denegación de servicio (referencia a puntero NULL y caída de sistema) a través de un dispositivo USB sin both a control y a data endpoint descriptor.
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly sanity check the endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash). Ben Hawkes discovered that the Linux kernel's AIO interface allowed single writes greater than 2GB, which could cause an integer overflow when writing to certain filesystems, socket or device types. A local attacker could this to cause a denial of service (system crash) or possibly execute arbitrary code. Various other issues were also addressed.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-03-09 CVE Published
- 2016-03-09 First Exploit
- 2016-03-13 CVE Reserved
- 2024-08-05 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (23)
| URL | Tag | Source |
|---|---|---|
| http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8835ba4a39cf53f705417b3b3a94eb067673f2c9 | X_refsource_confirm | |
| http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.1 | X_refsource_confirm | |
| http://www.openwall.com/lists/oss-security/2016/03/14/4 | Mailing List |
|
| https://bugzilla.redhat.com/show_bug.cgi?id=1316204 | X_refsource_confirm | |
| https://github.com/torvalds/linux/commit/8835ba4a39cf53f705417b3b3a94eb067673f2c9 | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/136138 | 2016-03-09 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | <= 4.5.0 Search vendor "Linux" for product "Linux Kernel" and version " <= 4.5.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | lts |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Software Development Kit Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" and version "11.0" | sp4 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Software Development Kit Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Software Development Kit Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" and version "12.0" | sp1 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Debuginfo Search vendor "Novell" for product "Suse Linux Enterprise Debuginfo" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Debuginfo" and version "11.0" | sp4 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Desktop Search vendor "Novell" for product "Suse Linux Enterprise Desktop" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Desktop" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Desktop Search vendor "Novell" for product "Suse Linux Enterprise Desktop" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Desktop" and version "12.0" | sp1 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Live Patching Search vendor "Novell" for product "Suse Linux Enterprise Live Patching" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Live Patching" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Module For Public Cloud Search vendor "Novell" for product "Suse Linux Enterprise Module For Public Cloud" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Module For Public Cloud" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Real Time Extension Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" and version "11.0" | sp4 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Real Time Extension Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" and version "12.0" | sp1 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "11.0" | extra |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "11.0" | sp4 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "12.0" | sp1 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Workstation Extension Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Workstation Extension Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" and version "12.0" | sp1 |
Affected
| ||||||