Login Request a demo
Medium severity · published Dec 12, 2017
CVE-2017-17558
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of…
6.6
CVSS
0.5%
EPSS
No
On KEV
Description
The usb_destroy_configuration function in drivers/usb/core/config.c in the USB core subsystem in the Linux kernel through 4.14.5 does not consider the maximum number of configurations and interfaces before attempting to release resources, which allows local users to cause a denial of service (out-of-bounds write access) or possibly have unspecified other impact via a crafted USB device.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
through 4.14.5 · source: NVD
LE
Linux Enterprise Server · Suse
11; 11 · source: NVD
Affected product
KE
Kernel
Linux
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-17558
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-17558
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2018-01/msg00007.html
Mailing List
http://openwall.com/lists/oss-security/2017/12/12/7
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:0676
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:1062
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:1170
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:1190
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability