VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2017-16650
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-16650
CVSS severity score: 7.2/10.0
Description:
The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel through 4.13.11 allows local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device.
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by groeck@chromium.org
, Nov 29 2017Labels: M-65 Security_Severity-High Security_Impact-None Pri-2
Mergedinto: 788817
Owner: groeck@chromium.org
Status: Duplicate (was: Untriaged)
Upstream commit 7fd078337201 ("net: qmi_wwan: fix divide by 0 on bad descriptors"). Not enabled in standard configurations. Can be enabled optionally with "qmi" USE flag. Already fixed in chromeos-4.14. Will fix in chromeos-4.4 with merge of v4.4.102. WontFix in older kernels.