NetSight
IP …
critical9.0

CVE-2015-4002

drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, wh…

Impact

drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 3.4.109
from 3.5 before 3.10.81
from 3.11 before 3.12.45
from 3.13 before 3.14.45
from 3.15 before 3.16.35
from 3.17 before 3.18.18
CanonicalUbuntu Linux
Versions 14.04, 15.10
OpensuseOpensuse
Version 13.2

Weakness classification

CWE-119

References