CVE-2017-8072
published 2017-04-23CVE-2017-8072: The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a…
PriorityP433high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.41%
33.5th percentile
The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.9.10-1 (bookworm) | linux 4.9.10-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 4.9.10-1 | 4.9.10-1 |
| linux | linux_kernel | >= 0 < 4.9.10-1 | 4.9.10-1 |
| linux | linux_kernel | >= 0 < 4.9.10-1 | 4.9.10-1 |
| linux | linux_kernel | >= 0 < 4.9.10-1 | 4.9.10-1 |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: cp2112_gpio_direction_input does not have the expected EIO error status for a zero-length report
vendor_redhat·2017-01-30·CVSS 7.8
CVE-2017-8072 [HIGH] kernel: cp2112_gpio_direction_input does not have the expected EIO error status for a zero-length report
kernel: cp2112_gpio_direction_input does not have the expected EIO error status for a zero-length report
The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: realtime-kernel (Red Hat Enterprise MRG 2) - Not affected
Debian
CVE-2017-8072: linux - The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linu...
vendor_debian·2017·CVSS 7.8
CVE-2017-8072 [HIGH] CVE-2017-8072: linux - The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linu...
The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.
Scope: local
bookworm: resolved (fixed in 4.9.10-1)
bullseye: resolved (fixed in 4.9.10-1)
forky: resolved (fixed in 4.9.10-1)
sid: resolved (fixed in 4.9.10-1)
trixie: resolved (fixed in 4.9.10-1)
GHSA
GHSA-7xr6-r55h-px6v: The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112
ghsa_unreviewed·2022-05-17
CVE-2017-8072 [HIGH] GHSA-7xr6-r55h-px6v: The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112
The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.
OSV
CVE-2017-8072: The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112
osv·2017-04-23·CVSS 7.8
CVE-2017-8072 [HIGH] CVE-2017-8072: The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112
The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.
No detection rules found.
No public exploits indexed.
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.9http://www.openwall.com/lists/oss-security/2017/04/16/4http://www.securityfocus.com/bid/98010https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8e9faa15469ed7c7467423db4c62aeed3ff4cae3https://github.com/torvalds/linux/commit/8e9faa15469ed7c7467423db4c62aeed3ff4cae3http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.9http://www.openwall.com/lists/oss-security/2017/04/16/4http://www.securityfocus.com/bid/98010https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8e9faa15469ed7c7467423db4c62aeed3ff4cae3https://github.com/torvalds/linux/commit/8e9faa15469ed7c7467423db4c62aeed3ff4cae3
2017-04-23
Published