Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-2782

CWE-476 — NULL Pointer Dereference19 documents9 sources
Severity
4.6MEDIUM
EPSS
0.5%
top 35.31%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
8
Linux Linux KernelSuse Linux Enterprise DebuginfoSuse Linux Enterprise Desktop+5 more
Timeline
PublishedApr 27
Latest updateMay 13

Description

The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1) bulk-in or (2) interrupt-in endpoint.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 0.9 | Impact: 3.6

Affected Packages9 packages

▶NVDlinux/linux_kernel< 4.5.0+1
▶Debianlinux< 4.4.2-1+3

Patches

Patch: git.kernel.org ↗Patch: github.com ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-vg8w-f22r-5p2c: The treo_attach function in drivers/usb/serial/visor↗2022-05-13
▶
OSV
CVE-2016-2782: The treo_attach function in drivers/usb/serial/visor↗2016-04-27
▶
CVEList
CVE-2016-2782: The treo_attach function in drivers/usb/serial/visor↗2016-04-27
▶

💥Exploits & PoCs

1
Exploit-DB
Linux Kernel 3.10.0 (CentOS / RHEL 7.1) - visor 'treo_attach' Nullpointer Dereference↗2016-03-09
▶

📋Vendor Advisories

11
Ubuntu
Linux kernel vulnerabilities↗2016-05-09
▶
Ubuntu
Linux kernel (OMAP4) vulnerabilities↗2016-05-09
▶
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities↗2016-04-06
▶
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities↗2016-03-16
▶
Ubuntu
Linux kernel (Wily HWE) vulnerabilities↗2016-03-14
▶

💬Community

3
Bugzilla
CVE-2016-2782 kernel: visor: crash on invalid USB device descriptors in treo_attach() in visor driver [fedora-all]↗2016-02-28
▶
Bugzilla
CVE-2016-2782 kernel: visor: crash on invalid USB device descriptors in treo_attach() in visor driver↗2016-02-28
▶
Bugzilla
CVE-2016-2782 Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid USB device descriptors (visor driver) [local-DoS]↗2015-11-18
▶