CVE-2017-17558
Summary
| CVE | CVE-2017-17558 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-12-12 15:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device. |
Risk And Classification
Primary CVSS: v3.0 6.6 MEDIUM from [email protected]
CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.000730000 probability, percentile 0.219880000 (date 2026-05-18)
Problem Types: CWE-787 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 6.6 | MEDIUM | CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
CVSS v3.0 Breakdown
Attack Vector
PhysicalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:L/AC:L/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | extra | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | sp4 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| [SECURITY] [DLA 1232-1] linux security update | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| [PATCH] USB: core: only clean up what we allocated — Linux USB | af854a3a-2127-422b-91ae-364da2661108 | www.spinics.net | Issue Tracking, Patch |
| USN-3619-1: Linux kernel vulnerabilities | Ubuntu security notices | af854a3a-2127-422b-91ae-364da2661108 | usn.ubuntu.com | |
| USN-3754-1: Linux kernel vulnerabilities | Ubuntu security notices | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | usn.ubuntu.com | |
| Debian -- Security Information -- DSA-4073-1 linux | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| [security-announce] SUSE-SU-2018:0011-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | Third Party Advisory |
| Oracle Critical Patch Update - October 2019 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | |
| oss-security - Re: Linux kernel: multiple vulnerabilities in the USB subsystem | af854a3a-2127-422b-91ae-364da2661108 | openwall.com | Mailing List, Third Party Advisory |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| Debian -- Security Information -- DSA-4082-1 linux | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| USN-3619-2: Linux kernel (Xenial HWE) vulnerabilities | Ubuntu security notices | af854a3a-2127-422b-91ae-364da2661108 | usn.ubuntu.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.