CVE-2016-3689

Published: 2 May 2016

The ims_pcu_parse_cdc_data function in drivers/input/misc/ims-pcu.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (system crash) via a USB device without both a master and a slave interface.

From the Ubuntu Security Team

It was discovered that the Linux kernel's USB driver for IMS Passenger Control Unit devices did not properly validate the device's interfaces. An attacker with physical access could use this to cause a denial of service (system crash).

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Priority

Low

CVSS 3 base score: 4.6

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3689
• https://bugzilla.novell.com/show_bug.cgi?id=971628
• https://bugzilla.redhat.com/show_bug.cgi?id=1320060
• https://ubuntu.com/security/notices/USN-2965-1
• https://ubuntu.com/security/notices/USN-2965-4
• https://ubuntu.com/security/notices/USN-2965-3
• https://ubuntu.com/security/notices/USN-2965-2
• https://ubuntu.com/security/notices/USN-2971-2
• https://ubuntu.com/security/notices/USN-2971-3
• https://ubuntu.com/security/notices/USN-2971-1
• https://ubuntu.com/security/notices/USN-2970-1
• https://ubuntu.com/security/notices/USN-2968-1
• https://ubuntu.com/security/notices/USN-2968-2
• https://ubuntu.com/security/notices/USN-3000-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1566581