CVE-2017-18360 in Linux
Summary
by MITRE
In change_port_settings in drivers/usb/serial/io_ti.c in the Linux kernel before 4.11.3, local users could cause a denial of service by division-by-zero in the serial device layer by trying to set very high baud rates.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/04/2023
The vulnerability identified as CVE-2017-18360 represents a critical denial of service flaw within the Linux kernel's USB serial device implementation. This issue resides in the change_port_settings function located in drivers/usb/serial/io_ti.c, specifically affecting kernel versions prior to 4.11.3. The vulnerability stems from inadequate input validation when processing serial port configuration parameters, particularly baud rate settings that exceed normal operational parameters. Attackers exploiting this weakness can trigger a system-wide denial of service condition by attempting to configure USB serial devices with extremely high baud rates that cause arithmetic exceptions during device initialization.
The technical implementation of this vulnerability demonstrates a classic division-by-zero error that occurs when the kernel attempts to calculate device parameters based on user-provided baud rate values. When an attacker specifies a very high baud rate that results in invalid mathematical operations during the serial port configuration process, the kernel's serial device layer fails with a division-by-zero exception. This exception causes the kernel to crash or become unresponsive, effectively rendering the affected system unavailable for legitimate serial communications. The flaw exists because the code does not properly validate the range of acceptable baud rate values before performing mathematical calculations required for device parameter configuration.
From an operational perspective, this vulnerability poses significant risks to systems relying on USB serial device connectivity, particularly in industrial environments, embedded systems, and server infrastructure where serial communication is critical. The denial of service impact extends beyond individual device functionality to potentially compromise entire system availability, especially when multiple serial devices are present or when the affected system serves as a communication gateway for other networked services. The local nature of this vulnerability means that exploitation requires local system access, but this access level is often sufficient in environments where attackers have compromised user accounts or physical access to systems.
The vulnerability maps directly to CWE-369, which specifically addresses the division by zero weakness, and aligns with ATT&CK technique T1499.004 for network denial of service attacks. Organizations using affected kernel versions face potential operational disruptions when attackers leverage this weakness to cause system instability. The impact is particularly concerning for embedded systems, IoT devices, and industrial control systems where serial communication is fundamental to device operation and where kernel updates may be delayed or restricted due to operational constraints.
Mitigation strategies for CVE-2017-18360 require immediate kernel version updates to 4.11.3 or later, which contain the necessary patches addressing the division-by-zero condition in the serial device layer. System administrators should prioritize patching affected systems, particularly those handling critical serial communications or operating in high-security environments. Additionally, implementing proper input validation at the application level and monitoring for unusual baud rate configurations can provide additional defensive layers. Organizations should also consider implementing access controls to limit local system access and establish monitoring procedures to detect potential exploitation attempts. The vulnerability highlights the importance of maintaining current kernel versions and proper security testing for device drivers that handle user-provided configuration parameters.