CVE-2016-2782 Null dereference in n/a
A physically proximate attacker can cause a system crash by inserting a malformed USB device into a Linux kernel with the visor driver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-2782?
CVE-2016-2782 is a medium-severity vulnerability in Linux kernel, published on 27 Apr 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.
Weakness: CWE-476
Which versions are affected by CVE-2016-2782?
It affects 8 products.
Products include Linux kernel, Suse Linux Enterprise Debuginfo, Suse Linux Enterprise Desktop, Suse Linux Enterprise Module for Public Cloud, Suse Linux Enterprise Real Time Extension, Suse Linux Enterprise Server and 2 more.
How do I fix CVE-2016-2782?
Apply the vendor's patch.
Is CVE-2016-2782 being exploited?
There is no known exploitation of CVE-2016-2782 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2016-2782, GHSA-vg8w-f22r-5p2c, UBUNTU-CVE-2016-2782.