CVE-2017-8924 — MEDIUM (4.6)

Q: How severe is CVE-2017-8924?

CVE-2017-8924 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2017-8924?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Debian Debian Linux.

Vulnerability Description

The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.

CVSS Score

4.6

MEDIUM

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Linux	Linux Kernel	<= 4.10.3
Debian	Debian Linux	8.0

Related Weaknesses (CWE)

CWE-191

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=654b40Issue TrackingPatchThird Party Advisory
http://www.debian.org/security/2017/dsa-3886Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.4Release NotesVendor Advisory
http://www.securityfocus.com/bid/98451Third Party AdvisoryVDB Entry
https://github.com/torvalds/linux/commit/654b404f2a222f918af9b0cd18ad469d0c941a8Issue TrackingPatchThird Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=654b40Issue TrackingPatchThird Party Advisory
http://www.debian.org/security/2017/dsa-3886Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.4Release NotesVendor Advisory
http://www.securityfocus.com/bid/98451Third Party AdvisoryVDB Entry
https://github.com/torvalds/linux/commit/654b404f2a222f918af9b0cd18ad469d0c941a8Issue TrackingPatchThird Party Advisory

FAQ

What is CVE-2017-8924?

CVE-2017-8924 is a vulnerability with a CVSS score of 4.6 (MEDIUM). The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitia...

How severe is CVE-2017-8924?

CVE-2017-8924 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-8924?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Debian Debian Linux.