Resource management errors in Linux kernel - CVE-2007-5093

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU95219

Resource management errors in Linux kernel - CVE-2007-5093

Published: September 27, 2007 / Updated: February 13, 2023


Vulnerability identifier: #VU95219
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2007-5093
CWE-ID: CWE-399
Exploitation vector: Local access
Exploit availability: No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel

Detailed vulnerability description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 'relies on user space to close the device,' which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing the device after the disconnect is invoked. NOTE: this rarely crosses privilege boundaries, unless the attacker can convince the victim to unplug the affected device.


How to mitigate CVE-2007-5093

Install update from vendor's repository.

Sources