CVE-2016-3138 in Linux
Summary
by MITRE
The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/27/2022
The vulnerability described in CVE-2016-3138 represents a critical null pointer dereference flaw within the Linux kernel's USB communication subsystem, specifically affecting the CDC-ACM (Communication Device Class - Abstract Control Model) driver. This issue exists in the acm_probe function located in drivers/usb/class/cdc-acm.c and impacts Linux kernel versions prior to 4.5.1, making it a significant concern for systems running older kernel versions. The vulnerability is particularly dangerous because it can be exploited by attackers who are physically proximate to the target system, meaning they need only be in close physical proximity to the device to potentially trigger the exploit.
The technical root cause of this vulnerability stems from inadequate input validation within the USB device enumeration process. When a USB device is connected to a system running an affected kernel version, the acm_probe function attempts to process the device's endpoint descriptors without properly verifying that both control and data endpoint descriptors are present. This function fails to check whether the required endpoint descriptors exist before attempting to access them, leading to a NULL pointer dereference when the system tries to process a USB device that lacks the expected endpoint configuration. The absence of proper validation creates a scenario where the kernel's USB subsystem crashes when encountering malformed USB device descriptors, resulting in a complete system crash or denial of service condition that requires manual reboot to recover.
From an operational impact perspective, this vulnerability poses significant risks to systems where physical proximity attacks are possible, such as in public spaces, shared work environments, or any scenario where unauthorized individuals might have access to connect USB devices to target systems. The attack vector is particularly concerning because it requires minimal technical expertise to exploit, as attackers only need to connect a malicious USB device that lacks proper endpoint descriptors. This vulnerability aligns with CWE-476, which describes NULL pointer dereference conditions, and represents a classic example of insufficient input validation that can lead to system instability and potential denial of service conditions. The vulnerability also maps to ATT&CK technique T1059.001, as it enables an attacker to potentially gain system access through USB-based attack vectors, though the immediate impact is limited to denial of service rather than arbitrary code execution.
The mitigation strategies for this vulnerability primarily involve kernel version updates to 4.5.1 or later, which contain the necessary patches to properly validate USB device endpoint descriptors before attempting to process them. System administrators should prioritize updating affected systems, particularly those in environments where physical security cannot be guaranteed. Additional mitigations include implementing USB device whitelisting policies, disabling USB ports when not required, and employing USB device monitoring solutions that can detect and prevent unauthorized USB device connections. Organizations should also consider implementing USB security frameworks that can prevent malicious USB devices from being recognized by the system, thereby preventing the vulnerable acm_probe function from being triggered. The fix implemented in the patched kernel versions ensures that proper validation checks are performed on USB device descriptors before any processing occurs, eliminating the possibility of NULL pointer dereference conditions and maintaining system stability even when encountering malformed USB devices.