CVE-2016-3138

Published: 2 May 2016

The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.

From the Ubuntu security team

Sergej Schumilo, Hendrik Schwartke, and Ralf Spenneberg discovered that the USB abstract device control driver for modems and ISDN adapters did not validate endpoint descriptors. An attacker with physical access could use this to cause a denial of service (system crash).

Priority

Low

CVSS 3 base score: 4.6

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3138
• http://www.openwall.com/lists/oss-security/2016/03/14/4
• http://seclists.org/bugtraq/2016/Mar/54
• https://bugzilla.redhat.com/show_bug.cgi?id=1283366
• https://ubuntu.com/security/notices/USN-2965-1
• https://ubuntu.com/security/notices/USN-2965-4
• https://ubuntu.com/security/notices/USN-2965-3
• https://ubuntu.com/security/notices/USN-2965-2
• https://ubuntu.com/security/notices/USN-2971-2
• https://ubuntu.com/security/notices/USN-2971-3
• https://ubuntu.com/security/notices/USN-2971-1
• https://ubuntu.com/security/notices/USN-2970-1
• https://ubuntu.com/security/notices/USN-2969-1
• https://ubuntu.com/security/notices/USN-2968-1
• https://ubuntu.com/security/notices/USN-2968-2
• https://ubuntu.com/security/notices/USN-2996-1
• https://ubuntu.com/security/notices/USN-2997-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1556880