Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

A local attacker can insert a malicious USB device, in order to
trigger an overflow in the USB driver, which leads to a denial of
service, or to code execution.

Impacted products: Fedora, Linux

Severity: 2/4

Creation date: 15/03/2013

DESCRIPTION OF THE VULNERABILITY

The drivers/usb/class/cdc-wdm.c file implements USB CDC
(Communication Device Class) WCM (WebCaM) Device Management.

The wdm_in_callback() function is called to copy messages received
from the USB device. However, if a USB reply is too long, a buffer
overflow occurs.

A local attacker can therefore insert a malicious USB device, in
order to trigger an overflow in the USB driver, which leads to a
denial of service, or to code execution.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/Linux-kernel-buffer-overflow-of-USB-cdc-wdm-12528