CVE-2015-4003
HighSummary
The oz_usb_handle_ep_data function in the OZWPAN driver in the Linux kernel through version 4.0.5 allows remote attackers to cause a denial of service via a crafted packet, leading to a divide-by-zero error and system crash.
Risk Assessment
Attackers can exploit this vulnerability to remotely crash the system, potentially leading to service downtime and loss of availability.
Recommendation
It is recommended to update the Linux kernel to version 4.0.6 or later to mitigate this vulnerability.
Other vulnerabilities in OZWPAN driver in the Linux kernel
See all- CVE-2015-4002High
In the Linux kernel up to version 4.0.5, there is a vulnerability in the OZWPAN driver that does not ensure certain length values are sufficiently large. This allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted packet.
- CVE-2015-4001High
An integer signedness error in the oz_hcd_get_desc_cnf function in the OZWPAN driver in the Linux kernel through version 4.0.5 may allow remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.
Original NVD description (English source)
The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via a crafted packet.