Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

Linux kernel 4.4.1 crash when malicious USB device inserted

CVE-2015-7566 · published 10 years ago
Summary

The Linux kernel (versions up to 4.4.1) and Suse Linux Enterprise products that include it can crash if someone plugs in a specially crafted USB device that lacks a required data channel. This requires the attacker to be physically near the machine. Update to a newer kernel version that fixes the issue or limit the use of unknown USB devices to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
novell suse_linux_enterprise_software_development_kit 11
cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*
novell suse_linux_enterprise_debuginfo 11
cpe:2.3:o:novell:suse_linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
novell suse_linux_enterprise_real_time_extension 11
12
cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:11:sp4:*:*:*:*:*:*
novell suse_linux_enterprise_server 11
cpe:2.3:o:novell:suse_linux_enterprise_server:11:extra:*:*:*:*:*:*
linux linux_kernel <= 4.4.1
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Original advisory text
The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system cr...
The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.6 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published8 Feb 2016
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-7566 · NVD
Track software like this
Free during beta