CVE-2017-8071

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 uses a spinlock without considering that sleeping is possible in a USB HID request callback, which allows local users to cause a denial of service (deadlock) via unspecified vectors.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.9Release Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2017/04/16/4Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/97991Third Party Advisory, VDB Entry
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7a7b5df84b6b4e5d599c7289526eed96541a0654Patch
https://github.com/torvalds/linux/commit/7a7b5df84b6b4e5d599c7289526eed96541a0654Patch
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.9Release Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2017/04/16/4Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/97991Third Party Advisory, VDB Entry
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7a7b5df84b6b4e5d599c7289526eed96541a0654Patch
https://github.com/torvalds/linux/commit/7a7b5df84b6b4e5d599c7289526eed96541a0654Patch

Timeline

Published: Apr 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-80727.8The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO e CVE-2017-80737.5WeeChat before 1.7.1 allows a remote crash by sending a filename via DCC to the IRC plugin. This occurs in the irc_ctcp_dcc_filename_without CVE-2017-80749.8On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadec CVE-2017-80759.8On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. Th CVE-2017-80769.8On the TP-Link TL-SG108E 1.0, admin network communications are RC4 encoded, even though RC4 is deprecated. This affects the 1.1.2 Build 2014 CVE-2017-80777.5On the TP-Link TL-SG108E 1.0, there is a hard-coded ciphering key (a long string beginning with Ei2HNryt). This affects the 1.1.2 Build 2014 CVE-2017-80785.3On the TP-Link TL-SG108E 1.0, the upgrade process can be requested remotely without authentication (httpupg.cgi with a parameter called cmd)CVE-2017-80808.8Atlassian Hipchat Server before 2.2.4 allows remote authenticated users with user level privileges to execute arbitrary code via vectors inv CVE-2017-80818.8Poor cryptographic salt initialization in admin/inc/template_functions.php in GetSimple CMS 3.3.13 allows a network attacker to escalate pri CVE-2017-80826.5concrete5 8.1.0 has CSRF in Thumbnail Editor in the File Manager, which allows remote attackers to disable the entire installation by merely CVE-2017-80836.7CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of f CVE-2017-80856.1In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.