CVE-2017-16911medium
Description
The vhci_hcd driver in the Linux Kernel before version 4.14.8 and 4.4.114 allows allows local attackers to disclose kernel memory addresses. Successful exploitation requires that a USB device is attached over IP.
References
http://www.securityfocus.com/bid/102156
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.8
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.114
https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html
https://secuniaresearch.flexerasoftware.com/advisories/80454/
https://secuniaresearch.flexerasoftware.com/secunia_research/2017-20/
https://usn.ubuntu.com/3619-1/
https://usn.ubuntu.com/3619-2/
https://usn.ubuntu.com/3754-1/
Details
Source: MITRE
Published: 2018-01-31
Updated: 2018-08-24
Type: CWE-200
Risk Information
CVSS v2
Base Score: 1.9
Vector: AV:L/AC:M/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 3.4
Severity: LOW
CVSS v3
Base Score: 4.7
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Impact Score: 3.6
Exploitability Score: 1
Severity: MEDIUM