Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-3139

CWE-476 — NULL Pointer Dereference11 documents8 sources
Severity
4.6MEDIUM
EPSS
0.1%
top 68.08%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
9
Linux Linux KernelNovell Suse Linux Enterprise DebuginfoNovell Suse Linux Enterprise Desktop+6 more
Timeline
PublishedApr 27
Latest updateMay 17

Description

The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel before 3.17 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor.

CVSS vector

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 0.9 | Impact: 3.6

Affected Packages10 packages

▶NVDlinux/linux_kernel3.16.7
▶Debianlinux< 4.0.2-1+3

🔴Vulnerability Details

3
GHSA
GHSA-q835-79mw-g5c8: The wacom_probe function in drivers/input/tablet/wacom_sys↗2022-05-17
▶
OSV
CVE-2016-3139: The wacom_probe function in drivers/input/tablet/wacom_sys↗2016-04-27
▶
CVEList
CVE-2016-3139: The wacom_probe function in drivers/input/tablet/wacom_sys↗2016-04-27
▶

💥Exploits & PoCs

1
Exploit-DB
Linux Kernel 3.10.0 (CentOS / RHEL 7.1) - 'Wacom' Multiple Nullpointer Dereferences↗2016-03-09
▶

📋Vendor Advisories

2
Red Hat
kernel: Crash on invalid USB device descriptors (wacom driver)↗2016-03-09
▶
Debian
CVE-2016-3139: linux - The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel...↗2016
▶

💬Community

4
Bugzilla
CVE-2016-3138 CVE-2016-3139 CVE-2016-3140 CVE-2016-3137 CVE-2016-3136 CVE-2016-2184 CVE-2016-2185 CVE-2016-2186 CVE-2016-2187 CVE-2016-2188 kernel: various crashes on invalid usb device descriptors [f↗2016-03-11
▶
Bugzilla
CVE-2016-3139 kernel: Crash on invalid USB device descriptors (wacom driver)↗2016-03-11
▶
Bugzilla
CVE-2016-3139 Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid USB device descriptors (wacom driver) [local-DoS] Bug2↗2015-11-18
▶
Bugzilla
CVE-2016-3139 Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid USB device descriptors (wacom driver) [local-DoS]↗2015-11-18
▶