CVE-2017-7273
medium
CVSS v3
6.6
CVSS v2
4.6
VIR risk
6.6
Description
The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux kernel 3.2 and 4.x before 4.9.4 allows physically proximate attackers to cause a denial of service (integer underflow) or possibly have unspecified other impact via a crafted HID report.
Predictions
Exploit likelihood
65%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-7273
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-7273.html
Vendor advisory: cve@mitre.org — https://github.com/torvalds/linux/commit/1ebb71143758f45dc0fa76e2f48429e13b16d110
Vendor advisory: cve@mitre.org — http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.4
Vendor advisory: cve@mitre.org — http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1ebb71143758f45dc0fa76e2f48429e13b16d110
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 4.9.6-1 |
| debian | bullseye | fixed | 4.9.6-1 |
| debian | forky | fixed | 4.9.6-1 |
| debian | sid | fixed | 4.9.6-1 |
| debian | trixie | fixed | 4.9.6-1 |
| linux-kernel | 4.0 | affected | |
| linux-kernel | 4.0.0 | affected | |
| linux-kernel | 4.0.2 | affected | |
| linux-kernel | 4.0.3 | affected | |
| linux-kernel | 4.0.4 | affected | |
| linux-kernel | 4.0.5 | affected | |
| linux-kernel | 4.0.6 | affected | |
| linux-kernel | 4.0.7 | affected | |
| linux-kernel | 4.0.8 | affected | |
| linux-kernel | 4.0.9 | affected | |
| linux-kernel | 4.1.0 | affected | |
| linux-kernel | 4.1.2 | affected | |
| linux-kernel | 4.1.3 | affected | |
| linux-kernel | 4.1.4 | affected | |
| linux-kernel | 4.1.5 | affected | |
| linux-kernel | 4.1.6 | affected | |
| linux-kernel | 4.1.7 | affected | |
| linux-kernel | 4.1.8 | affected | |
| linux-kernel | 4.1.9 | affected | |
| linux-kernel | 4.1.10 | affected | |
| linux-kernel | 4.1.11 | affected | |
| linux-kernel | 4.1.12 | affected | |
| linux-kernel | 4.1.13 | affected | |
| linux-kernel | 4.1.14 | affected | |
| linux-kernel | 4.1.15 | affected | |
| linux-kernel | 4.1.16 | affected | |
| linux-kernel | 4.1.17 | affected | |
| linux-kernel | 4.1.18 | affected | |
| linux-kernel | 4.1.19 | affected | |
| linux-kernel | 4.1.20 | affected | |
| linux-kernel | 4.1.21 | affected | |
| linux-kernel | 4.1.22 | affected | |
| linux-kernel | 4.1.23 | affected | |
| linux-kernel | 4.1.33 | affected | |
| linux-kernel | 4.2.0 | affected | |
| linux-kernel | 4.2.1 | affected | |
| linux-kernel | 4.2.2 | affected | |
| linux-kernel | 4.2.3 | affected | |
| linux-kernel | 4.2.4 | affected | |
| linux-kernel | 4.2.5 | affected | |
| linux-kernel | 4.2.7 | affected | |
| linux-kernel | 4.2.8 | affected | |
| linux-kernel | 4.3 | affected | |
| linux-kernel | 4.3.0 | affected | |
| linux-kernel | 4.3.1 | affected | |
| linux-kernel | 4.3.2 | affected | |
| linux-kernel | 4.3.3 | affected | |
| linux-kernel | 4.3.5 | affected | |
| linux-kernel | 4.3.6 | affected | |
| linux-kernel | 4.4 | affected | |
| linux-kernel | 4.4.0 | affected | |
| linux-kernel | 4.4.1 | affected | |
| linux-kernel | 4.4.2 | affected | |
| linux-kernel | 4.4.3 | affected | |
| linux-kernel | 4.4.4 | affected | |
| linux-kernel | 4.4.5 | affected | |
| linux-kernel | 4.4.6 | affected | |
| linux-kernel | 4.4.7 | affected | |
| linux-kernel | 4.4.8 | affected | |
| linux-kernel | 4.4.9 | affected | |
| linux-kernel | 4.4.22 | affected | |
| linux-kernel | 4.4.23 | affected | |
| linux-kernel | 4.4.24 | affected | |
| linux-kernel | 4.4.25 | affected | |
| linux-kernel | 4.4.26 | affected | |
| linux-kernel | 4.4.27 | affected | |
| linux-kernel | 4.4.28 | affected | |
| linux-kernel | 4.4.32 | affected | |
| linux-kernel | 4.5.0 | affected | |
| linux-kernel | 4.5.1 | affected | |
| linux-kernel | 4.5.2 | affected | |
| linux-kernel | 4.5.3 | affected | |
| linux-kernel | 4.5.4 | affected | |
| linux-kernel | 4.5.5 | affected | |
| linux-kernel | 4.5.7 | affected | |
| linux-kernel | 4.6 | affected | |
| linux-kernel | 4.6.2 | affected | |
| linux-kernel | 4.6.3 | affected | |
| linux-kernel | 4.6.4 | affected | |
| linux-kernel | 4.6.5 | affected | |
| linux-kernel | 4.6.6 | affected | |
| linux-kernel | 4.6.7 | affected | |
| linux-kernel | 4.7 | affected | |
| linux-kernel | 4.7.4 | affected | |
| linux-kernel | 4.7.6 | affected | |
| linux-kernel | 4.8 | affected | |
| linux-kernel | 4.8.1 | affected | |
| linux-kernel | 4.8.2 | affected | |
| linux-kernel | 4.8.3 | affected | |
| linux-kernel | 4.8.4 | affected | |
| linux-kernel | 4.8.5 | affected | |
| linux-kernel | 4.8.6 | affected | |
| linux-kernel | 4.8.7 | affected | |
| linux-kernel | 4.8.8 | affected | |
| linux-kernel | 4.8.9 | affected | |
| linux-kernel | 4.8.10 | affected | |
| linux-kernel | 4.8.11 | affected | |
| linux-kernel | 4.8.12 | affected | |
| linux-kernel | 4.8.14 | affected | |
| linux-kernel | 4.8.16 | affected | |
| linux-kernel | 4.8.17 | affected | |
| linux-kernel | 4.9.1 | affected | |
| linux-kernel | 4.9.2 | affected | |
| linux-kernel | 4.9.3 | affected | |
| linux-kernel | 4.10 | affected | |
| linux-kernel | 4.10.1 | affected | |
| linux-kernel | 4.10.2 | affected | |
| linux-kernel | 4.10.4 | affected | |
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1ebb71143758f45dc0fa76e2f48429e13b16d110
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4faec4a2ef5dd481682cc155cb9ea14ba2534b76
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.4
- http://www.securityfocus.com/bid/97190
- https://github.com/torvalds/linux/commit/1ebb71143758f45dc0fa76e2f48429e13b16d110
- https://www.suse.com/security/cve/CVE-2017-7273.html
- https://security-tracker.debian.org/tracker/CVE-2017-7273
Verify integrity in audit chain (admin only). AS-IS.