CVE-2016-2187 — MEDIUM (4.6)

Q: How severe is CVE-2016-2187?

CVE-2016-2187 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2016-2187?

Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Linux Linux Kernel, Novell Suse Linux Enterprise Software Development Kit, Novell Suse Linux Enterprise Debuginfo, Novell Suse Linux Enterprise Server.

Vulnerability Description

The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.

CVSS Score

4.6

MEDIUM

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Canonical	Ubuntu Linux	12.04
Linux	Linux Kernel	<= 4.5.2
Novell	Suse Linux Enterprise Software Development Kit	11.0
Novell	Suse Linux Enterprise Debuginfo	11
Novell	Suse Linux Enterprise Server	11

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=162f98PatchVendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html
http://www.debian.org/security/2016/dsa-3607
http://www.securityfocus.com/bid/85425
http://www.ubuntu.com/usn/USN-2989-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2996-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2997-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2998-1Third Party Advisory
http://www.ubuntu.com/usn/USN-3000-1Third Party Advisory
http://www.ubuntu.com/usn/USN-3001-1Third Party Advisory
http://www.ubuntu.com/usn/USN-3002-1Third Party Advisory
http://www.ubuntu.com/usn/USN-3003-1Third Party Advisory
http://www.ubuntu.com/usn/USN-3004-1Third Party Advisory
http://www.ubuntu.com/usn/USN-3005-1Third Party Advisory

FAQ

What is CVE-2016-2187?

CVE-2016-2187 is a vulnerability with a CVSS score of 4.6 (MEDIUM). The gtco_probe function in drivers/input/tablet/gtco.c in the Linux kernel through 4.5.2 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) ...

How severe is CVE-2016-2187?

CVE-2016-2187 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-2187?

Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Linux Linux Kernel, Novell Suse Linux Enterprise Software Development Kit, Novell Suse Linux Enterprise Debuginfo, Novell Suse Linux Enterprise Server.