CVE-2017-8924

The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow.

Weakness

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Affected Software

References

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=654b404f2a222f918af9b0cd18ad469d0c941a8e
• http://www.debian.org/security/2017/dsa-3886
• http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.4
• http://www.securityfocus.com/bid/98451
• https://github.com/torvalds/linux/commit/654b404f2a222f918af9b0cd18ad469d0c941a8e
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=654b404f2a222f918af9b0cd18ad469d0c941a8e
• http://www.debian.org/security/2017/dsa-3886
• http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.10.4
• http://www.securityfocus.com/bid/98451
• https://github.com/torvalds/linux/commit/654b404f2a222f918af9b0cd18ad469d0c941a8e