CVE-2015-4001
HighSummary
An integer signedness error in the oz_hcd_get_desc_cnf function in the OZWPAN driver in the Linux kernel through version 4.0.5 may allow remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.
Risk Assessment
This vulnerability poses a risk of system crash and potential remote code execution, which can lead to serious security implications for the organization.
Recommendation
It is recommended to update the Linux kernel to version 4.0.5 or later to mitigate this vulnerability.
Other vulnerabilities in OZWPAN driver in the Linux kernel
See all- CVE-2015-4003High
The oz_usb_handle_ep_data function in the OZWPAN driver in the Linux kernel through version 4.0.5 allows remote attackers to cause a denial of service via a crafted packet, leading to a divide-by-zero error and system crash.
- CVE-2015-4002High
In the Linux kernel up to version 4.0.5, there is a vulnerability in the OZWPAN driver that does not ensure certain length values are sufficiently large. This allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted packet.
Original NVD description (English source)
Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.