CVE-2015-4002
HighSummary
In the Linux kernel up to version 4.0.5, there is a vulnerability in the OZWPAN driver that does not ensure certain length values are sufficiently large. This allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted packet.
Risk Assessment
This vulnerability can lead to system crashes or allow remote code execution, posing a serious security threat to the organization.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability and to monitor systems for potential attack attempts.
Other vulnerabilities in OZWPAN driver in the Linux kernel
See all- CVE-2015-4003High
The oz_usb_handle_ep_data function in the OZWPAN driver in the Linux kernel through version 4.0.5 allows remote attackers to cause a denial of service via a crafted packet, leading to a divide-by-zero error and system crash.
- CVE-2015-4001High
An integer signedness error in the oz_hcd_get_desc_cnf function in the OZWPAN driver in the Linux kernel through version 4.0.5 may allow remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.
Original NVD description (English source)
drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) oz_usb_rx and (2) oz_usb_handle_ep_data functions.