CVE-2015-7833

Published: 19 October 2015

The usbvision driver in the Linux kernel package 3.10.0-123.20.1.el7 through 3.10.0-229.14.1.el7 in Red Hat Enterprise Linux (RHEL) 7.1 allows physically proximate attackers to cause a denial of service (panic) via a nonzero bInterfaceNumber value in a USB device descriptor.

From the Ubuntu Security Team

Ralf Spenneberg discovered that the usbvision driver in the Linux kernel did not properly sanity check the interfaces and endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash).

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

need to check if usbvision driver is in any Ubuntu kernels

The original fix was 588afcc1c0e4;  however it was determined to
be bad and fa52bd506f was applied instead, and d5468d7af is intended
to revert 588afcc1c0e4.

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7833
• https://bugzilla.redhat.com/show_bug.cgi?id=1201858
• http://www.os-s.net/advisories/DOS-KernelCrashesOnInvalidUSBDeviceDescriptors-UsbvisionDriver.pdf
• http://seclists.org/bugtraq/2015/Oct/35
• https://ubuntu.com/security/notices/USN-2932-1
• https://ubuntu.com/security/notices/USN-2929-2
• https://ubuntu.com/security/notices/USN-2929-1
• https://ubuntu.com/security/notices/USN-2947-1
• https://ubuntu.com/security/notices/USN-2947-2
• https://ubuntu.com/security/notices/USN-2947-3
• https://ubuntu.com/security/notices/USN-2948-1
• https://ubuntu.com/security/notices/USN-2967-2
• https://ubuntu.com/security/notices/USN-2967-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1508331