CVE-2017-16913 in Linux
Summary
by MITRE
The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) in the Linux Kernel before version 4.14.8, 4.9.71, and 4.4.114 when handling CMD_SUBMIT packets allows attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/14/2025
The vulnerability identified as CVE-2017-16913 represents a critical denial of service flaw within the Linux kernel's USB over IP implementation. This issue affects the stub_recv_cmd_submit() function located in drivers/usb/usbip/stub_rx.c, which processes CMD_SUBMIT packets used in USB over IP communication protocols. The vulnerability stems from improper validation of packet parameters during the processing of USB requests, creating an avenue for malicious actors to exploit memory allocation behaviors within the kernel space. The affected versions include all Linux kernel releases prior to 4.14.8, 4.9.71, and 4.4.114, indicating a widespread impact across multiple kernel branches that were actively maintained and deployed in production environments.
The technical flaw manifests when the kernel receives specially crafted USB over IP packets that contain malformed or excessive parameters in CMD_SUBMIT requests. The stub_recv_cmd_submit() function fails to properly validate the size and structure of incoming data, allowing attackers to trigger arbitrary memory allocation requests that can exhaust system resources or cause kernel memory corruption. This vulnerability operates at the kernel level, meaning that successful exploitation can lead to system instability, complete denial of service, or potentially more severe consequences depending on the execution context. The flaw specifically relates to insufficient input validation and memory management practices within the USB over IP subsystem, which is designed to enable USB device sharing across network connections.
The operational impact of CVE-2017-16913 extends beyond simple service disruption as it can be leveraged to cause significant system instability in environments where USB over IP functionality is enabled. Systems running affected kernel versions that expose USB over IP services to untrusted networks become vulnerable to attacks that can consume excessive memory resources, leading to system hangs or crashes. The vulnerability is particularly concerning in server environments where USB over IP might be used for device sharing, remote debugging, or specialized hardware access scenarios. From a cybersecurity perspective, this vulnerability aligns with CWE-129, which addresses improper validation of input ranges, and can be mapped to ATT&CK technique T1499.004 for network denial of service attacks. The flaw's exploitation potential is enhanced in environments where USB over IP services are exposed to external networks without proper access controls or network segmentation.
Mitigation strategies for CVE-2017-16913 primarily focus on immediate kernel version updates to patched releases, with administrators urged to upgrade to kernel versions 4.14.8, 4.9.71, or 4.4.114 and subsequent releases. Organizations should also implement network segmentation to limit access to USB over IP services, disable USB over IP functionality when not required, and monitor for unusual memory allocation patterns or service disruptions that might indicate exploitation attempts. Additional protective measures include implementing network access controls to restrict USB over IP packet transmission to trusted sources only, and conducting thorough vulnerability assessments of systems that may be exposed to untrusted USB over IP traffic. The vulnerability demonstrates the importance of proper input validation in kernel space code and highlights the need for comprehensive security testing of device drivers and network protocol implementations within operating system kernels.