CVE-2016-2186

Published on: 05/02/2016 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:14 PM UTC

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Certain versions of Ubuntu Linux from Canonical contain the following vulnerability:

The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.

  • CVE-2016-2186 has been assigned by [email protected] to track the vulnerability - currently rated as MEDIUM severity.

CVSS3 Score: 4.6 - MEDIUM

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
PHYSICAL LOW NONE NONE
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED NONE NONE HIGH

CVSS2 Score: 4.9 - MEDIUM

Access
Vector
Access
Complexity
Authentication
LOCAL LOW NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
NONE NONE COMPLETE

CVE References

Description Tags Link
[security-announce] openSUSE-SU-2016:1382-1: important: Security update lists.opensuse.org
text/html
URL Logo SUSE openSUSE-SU-2016:1382
Input: powermate - fix oops with malicious USB descriptors · torvalds/[email protected] · GitHub Vendor Advisory
github.com
text/html
URL Logo CONFIRM github.com/torvalds/linux/commit/9c6ba456711687b794dcf285856fc14e2c76074f
USN-2969-1: Linux kernel (Utopic HWE) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2969-1
[security-announce] SUSE-SU-2016:1707-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1707
USN-2971-2: Linux kernel (Wily HWE) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2971-2
USN-2968-1: Linux kernel vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2968-1
kernel/git/torvalds/linux.git - Linux kernel source tree Vendor Advisory
git.kernel.org
text/html
URL Logo CONFIRM git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9c6ba456711687b794dcf285856fc14e2c76074f
Linux Kernel 'powermate' Driver Null Pointer Deference Local Denial of Service Vulnerability cve.report (archive)
text/html
URL Logo BID 84337
Bugtraq: oss-2016-13: Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid USB device descriptors (powermate driver) Exploit
Third Party Advisory
VDB Entry
seclists.org
text/html
URL Logo BUGTRAQ 20160310 oss-2016-13: Local RedHat Enterprise Linux DoS - RHEL 7.1 Kernel crashes on invalid USB device descriptors (powermate driver)
[security-announce] SUSE-SU-2016:2074-1: important: Security update for lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:2074
[security-announce] SUSE-SU-2016:1672-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1672
USN-2970-1: Linux kernel (Vivid HWE) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2970-1
No Description Provided Third Party Advisory
VDB Entry
seclists.org
text/html
URL Logo BUGTRAQ 20160315 Re: oss-2016-13: Local RedHat Enterprise Linux DoS - RHEL 7.1 Kernel crashes on invalid USB device descriptors (powermate driver)
USN-2968-2: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2968-2
Debian -- Security Information -- DSA-3607-1 linux www.debian.org
Depreciated Link
text/html
URL Logo DEBIAN DSA-3607
USN-2996-1: Linux kernel vulnerabilities | Ubuntu Third Party Advisory
www.ubuntu.com
text/html
URL Logo UBUNTU USN-2996-1
USN-2971-1: Linux kernel vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2971-1
1317015 – (CVE-2016-2186) CVE-2016-2186 kernel: Kernel panic on invalid USB device descriptor (powermate driver) Issue Tracking
Third Party Advisory
VDB Entry
bugzilla.redhat.com
text/html
URL Logo CONFIRM bugzilla.redhat.com/show_bug.cgi?id=1317015
[security-announce] SUSE-SU-2016:1764-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1764
[security-announce] SUSE-SU-2016:1690-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1690
[security-announce] SUSE-SU-2016:1696-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1696
www.kernel.org
text/plain
CONFIRM www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.1
USN-2997-1: Linux kernel (OMAP4) vulnerabilities | Ubuntu Third Party Advisory
www.ubuntu.com
text/html
URL Logo UBUNTU USN-2997-1
USN-2971-3: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2971-3

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
Operating
System
CanonicalUbuntu Linux12.04AllAllAll
Operating
System
CanonicalUbuntu Linux12.04AllAllAll
Operating
System
LinuxLinux KernelAllAllAllAll
Operating
System
NovellSuse Linux Enterprise Debuginfo11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Debuginfo11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Desktop12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Desktop12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Desktop12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Desktop12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Live Patching12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Live Patching12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Module For Public Cloud12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Module For Public Cloud12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Real Time Extension11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Real Time Extension12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Real Time Extension11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Real Time Extension12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Server11.0extraAllAll
Operating
System
NovellSuse Linux Enterprise Server11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Server12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Server12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Server11.0extraAllAll
Operating
System
NovellSuse Linux Enterprise Server11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Server12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Server12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Workstation Extension12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Workstation Extension12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Workstation Extension12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Workstation Extension12.0sp1AllAll
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*:
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*:
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_debuginfo:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_debuginfo:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_live_patching:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_live_patching:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_module_for_public_cloud:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_module_for_public_cloud:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:extra:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:extra:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:sp1:*:*:*:*:*:*: