CVE-2017-8072

Severity

72%

Complexity

39%

Confidentiality

165%

The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.

CVSS 3.0 Base Score 7.8. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 7.2. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C).

Overview

First reported 7 years ago

2017-04-23 05:59:00

Last updated 7 years ago

2017-04-27 17:50:00

Affected Software

Linux Kernel 4.9

4.9

Linux Kernel 4.9.1

4.9.1

Linux Kernel 4.9.2

4.9.2

Linux Kernel 4.9.3

4.9.3

Linux Kernel 4.9.4

4.9.4

Linux Kernel 4.9.5

4.9.5

Linux Kernel 4.9.6

4.9.6

Linux Kernel 4.9.8

4.9.8

References

http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.9

Release Notes, Vendor Advisory

[oss-security] 20170416 Silently (or obliviously) partially-fixed CONFIG_STRICT_DEVMEM bypass

Mailing List, Patch, Third Party Advisory

98010

Third Party Advisory, VDB Entry

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8e9faa15469ed7c7467423db4c62aeed3ff4cae3

Patch

https://github.com/torvalds/linux/commit/8e9faa15469ed7c7467423db4c62aeed3ff4cae3