Description
The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Flexera Software LLC Linux Kernel
Before version 4.14.8 and 4.4.114affected
References
- https://www.debian.org/security/2018/dsa-4187 ↗
- https://usn.ubuntu.com/3619-2/ ↗
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.114 ↗
- https://secuniaresearch.flexerasoftware.com/advisories/80454/ ↗
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/drivers/usb/usbip?id=2f2d0088eb93db5c649d2a5e34a3800a8a935fc5 ↗
- https://www.spinics.net/lists/linux-usb/msg163480.html ↗
- https://usn.ubuntu.com/3754-1/ ↗
- https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8 ↗
- http://www.securityfocus.com/bid/102156 ↗
- https://secuniaresearch.flexerasoftware.com/secunia_research/2017-20/ ↗
- https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html ↗
- https://usn.ubuntu.com/3619-1/ ↗