NVD Vulnerability Detail

CVE-2014-3185

Summary	Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.
Publication Date	Sept. 28, 2014, 7:55 p.m.
Registration Date	Jan. 26, 2021, 3:10 p.m.
Last Update	Nov. 21, 2024, 11:07 a.m.

CVSS2.0 : MEDIUM
Score	6.9
Vector	AV:L/AC:M/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:linux:linux_kernel::::::::	3.11			3.12.29
cpe:2.3:o:linux:linux_kernel::::::::	3.15			3.16.2
cpe:2.3:o:linux:linux_kernel::::::::	3.13			3.14.18
cpe:2.3:o:linux:linux_kernel::::::::	3.5			3.10.54
cpe:2.3:o:linux:linux_kernel::::::::	3.3			3.4.104
cpe:2.3:o:linux:linux_kernel::::::::				3.2.63

Related information, measures and tools

No	URL	タグ
1	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6817ae225cd650fb1c3295d769298c38b1eba818	Broken Link
2	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6817ae225cd650fb1c3295d769298c38b1eba818	Broken Link
3	http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html	Third Party Advisory VDB Entry
4	http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html	Third Party Advisory VDB Entry
5	http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html	Third Party Advisory VDB Entry
6	http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html	Third Party Advisory VDB Entry
7	http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html	Third Party Advisory VDB Entry
8	http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html	Third Party Advisory VDB Entry
9	http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html	Third Party Advisory VDB Entry
10	http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html	Third Party Advisory VDB Entry
11	http://rhn.redhat.com/errata/RHSA-2014-1318.html	Third Party Advisory VDB Entry
12	http://rhn.redhat.com/errata/RHSA-2014-1318.html	Third Party Advisory VDB Entry
13	http://rhn.redhat.com/errata/RHSA-2015-0284.html	Third Party Advisory VDB Entry
14	http://rhn.redhat.com/errata/RHSA-2015-0284.html	Third Party Advisory VDB Entry
15	http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.2	Mailing List Third Party Advisory
16	http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.2	Mailing List Third Party Advisory
17	http://www.openwall.com/lists/oss-security/2014/09/11/21	Mailing List
18	http://www.openwall.com/lists/oss-security/2014/09/11/21	Mailing List
19	http://www.securityfocus.com/bid/69781	Third Party Advisory VDB Entry
20	http://www.securityfocus.com/bid/69781	Third Party Advisory VDB Entry
21	http://www.ubuntu.com/usn/USN-2374-1	Third Party Advisory VDB Entry
22	http://www.ubuntu.com/usn/USN-2374-1	Third Party Advisory VDB Entry
23	http://www.ubuntu.com/usn/USN-2375-1	Third Party Advisory VDB Entry
24	http://www.ubuntu.com/usn/USN-2375-1	Third Party Advisory VDB Entry
25	http://www.ubuntu.com/usn/USN-2376-1	Third Party Advisory VDB Entry
26	http://www.ubuntu.com/usn/USN-2376-1	Third Party Advisory VDB Entry
27	http://www.ubuntu.com/usn/USN-2377-1	Third Party Advisory VDB Entry
28	http://www.ubuntu.com/usn/USN-2377-1	Third Party Advisory VDB Entry
29	http://www.ubuntu.com/usn/USN-2378-1	Third Party Advisory VDB Entry
30	http://www.ubuntu.com/usn/USN-2378-1	Third Party Advisory VDB Entry
31	http://www.ubuntu.com/usn/USN-2379-1	Third Party Advisory VDB Entry
32	http://www.ubuntu.com/usn/USN-2379-1	Third Party Advisory VDB Entry
33	https://bugzilla.redhat.com/show_bug.cgi?id=1141400	Issue Tracking
34	https://bugzilla.redhat.com/show_bug.cgi?id=1141400	Issue Tracking
35	https://code.google.com/p/google-security-research/issues/detail?id=98	Third Party Advisory
36	https://code.google.com/p/google-security-research/issues/detail?id=98	Third Party Advisory
37	https://github.com/torvalds/linux/commit/6817ae225cd650fb1c3295d769298c38b1eba818	Third Party Advisory
38	https://github.com/torvalds/linux/commit/6817ae225cd650fb1c3295d769298c38b1eba818	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

Linux Kernel の Whiteheat USB シリアルドライバの drivers/usb/serial/whiteheat.c におけるバッファオーバーフローの脆弱性

Title	Linux Kernel の Whiteheat USB シリアルドライバの drivers/usb/serial/whiteheat.c におけるバッファオーバーフローの脆弱性
Summary	Linux Kernel の Whiteheat USB シリアルドライバの drivers/usb/serial/whiteheat.c 内の command_port_read_callback 関数には、バッファオーバーフローの脆弱性が存在します。
Possible impacts	物理的に端末の操作が可能な攻撃者により、バルク応答に関連した大量の (1) EHCI または (2) XHCI データを返す巧妙に細工されたデバイスを介して、任意のコードを実行される、またはサービス運用妨害 (メモリ破損およびシステムクラッシュ) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 5, 2014, midnight
Registration Date	Sept. 30, 2014, 4:12 p.m.
Last Update	June 9, 2015, 6 p.m.

Affected System

Linux

Linux Kernel 3.16.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-3185	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3185
National Vulnerability Database (NVD)
2	CVE-2014-3185	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3185

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
ChangeLog
1	ChangeLog-3.16.2	https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.2
GitHub
2	USB: whiteheat: Added bounds checking for bulk command response	https://github.com/torvalds/linux/commit/6817ae225cd650fb1c3295d769298c38b1eba818
Google Code
3	Issue 98: Linux Kernel Buffer Overflow in Whiteheat USB Serial Driver	https://code.google.com/p/google-security-research/issues/detail?id=98
Linux Kernel
4	Linux Kernel Archives	http://www.kernel.org
Linux kernel source tree
5	USB: whiteheat: Added bounds checking for bulk command response	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6817ae225cd650fb1c3295d769298c38b1eba818
Red Hat Bugzilla
6	Bug 1141400	https://bugzilla.redhat.com/show_bug.cgi?id=1141400
Red Hat Security Advisory
7	RHSA-2014:1318	https://rhn.redhat.com/errata/RHSA-2014-1318.html
8	RHSA-2015:0284	https://rhn.redhat.com/errata/RHSA-2015-0284.html

Change Log

No	Changed Details	Date of change
0	[2014年09月30日] 掲載 [2014年11月21日] ベンダ情報：レッドハット (RHSA-2014:1318) を追加 [2015年06月09日] ベンダ情報：レッドハット (RHSA-2015:0284) を追加	Feb. 17, 2018, 10:37 a.m.