Vulnerability Description
The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Novell | Suse Linux Enterprise Software Development Kit | 11.0 |
| Novell | Suse Linux Enterprise Debuginfo | 11.0 |
| Novell | Suse Linux Enterprise Desktop | 12.0 |
| Novell | Suse Linux Enterprise Live Patching | 12.0 |
| Novell | Suse Linux Enterprise Module For Public Cloud | 12.0 |
| Novell | Suse Linux Enterprise Real Time Extension | 11.0 |
| Novell | Suse Linux Enterprise Server | 11.0 |
| Novell | Suse Linux Enterprise Workstation Extension | 12.0 |
| Linux | Linux Kernel | <= 4.5.0 |
| Canonical | Ubuntu Linux | 12.04 |
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4ec0efVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00056.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://seclists.org/bugtraq/2016/Mar/118Third Party AdvisoryVDB Entry
- http://seclists.org/bugtraq/2016/Mar/87ExploitThird Party AdvisoryVDB Entry
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.1
- http://www.ubuntu.com/usn/USN-2968-1
- http://www.ubuntu.com/usn/USN-2968-2
- http://www.ubuntu.com/usn/USN-2969-1
- http://www.ubuntu.com/usn/USN-2970-1
FAQ
What is CVE-2016-2188?
CVE-2016-2188 is a vulnerability with a CVSS score of 4.6 (MEDIUM). The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system cr...
How severe is CVE-2016-2188?
CVE-2016-2188 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-2188?
Check the references section above for vendor advisories and patch information. Affected products include: Novell Suse Linux Enterprise Software Development Kit, Novell Suse Linux Enterprise Debuginfo, Novell Suse Linux Enterprise Desktop, Novell Suse Linux Enterprise Live Patching, Novell Suse Linux Enterprise Module For Public Cloud.