Oval Definition:	oval:com.ubuntu.bionic:def:20178924000
Revision Date: 2017-05-12 Version: 1 Title: CVE-2017-8924 on Ubuntu 18.04 LTS (bionic) - medium. Description: The edge_bulk_in_callback function in drivers/usb/serial/io_ti.c in the Linux kernel before 4.10.4 allows local users to obtain sensitive information (in the dmesg ringbuffer and syslog) from uninitialized kernel memory by using a crafted USB device (posing as an io_ti USB serial device) to trigger an integer underflow. It was discovered that an integer underflow existed in the Edgeport USB Serial Converter device driver of the Linux kernel. An attacker with physical access could use this to expose sensitive information (kernel memory). Family: unix Class: vulnerability Status: Reference(s): CVE-2017-8924 Platform(s): Ubuntu 18.04 LTS Product(s): Definition Synopsis Ubuntu 18.04 LTS (bionic) is installed. AND Package Information NOT While related to the CVE in some way, the 'linux' package in bionic is not affected (note: '4.13.0-16.19'). OR NOT While related to the CVE in some way, the 'linux-aws' package in bionic is not affected (note: '4.15.0-1001.1'). OR NOT While related to the CVE in some way, the 'linux-azure' package in bionic is not affected (note: '4.15.0-1002.2'). OR NOT While related to the CVE in some way, the 'linux-gcp' package in bionic is not affected (note: '4.15.0-1001.1'). OR NOT While related to the CVE in some way, the 'linux-hwe' package in bionic is not affected. OR The 'linux-hwe-edge' package in bionic is affected. An update containing the fix has been completed and is pending publication (note: '4.18.0-8.9~18.04.1'). OR NOT While related to the CVE in some way, the 'linux-kvm' package in bionic is not affected (note: '4.15.0-1002.2'). OR NOT While related to the CVE in some way, the 'linux-oem' package in bionic is not affected (note: '4.15.0-1002.3'). OR NOT While related to the CVE in some way, the 'linux-raspi2' package in bionic is not affected (note: '4.13.0-1005.5').
BACK