CVE-2017-8072

high

Published 2017-04-23 · Modified 2026-05-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

7.8

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.8

Description

The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2017-8072 NameCVE-2017-8072 DescriptionThe cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE…

CVE-2017-8072

Name	CVE-2017-8072
Description	The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bullseye	5.10.223-1	fixed
	bullseye (security)	5.10.257-1	fixed
	bookworm	6.1.170-3	fixed
	bookworm (security)	6.1.172-1	fixed
	trixie	6.12.86-1	fixed
	trixie (security)	6.12.90-1	fixed
	forky	7.0.9-1	fixed
	sid	7.0.10-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
linux	source	wheezy	(not affected)
linux	source	jessie	(not affected)
linux	source	(unstable)	4.9.10-1

Notes

[jessie] - linux <not-affected> (Vulnerable code not present)
[wheezy] - linux <not-affected> (Vulnerable code not present)
Fixed by: https://git.kernel.org/linus/8e9faa15469ed7c7467423db4c62aeed3ff4cae3

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[jessie] - linux <not-affected> (Vulnerable code not present)[wheezy] - linux <not-affected> (Vulnerable code not present)Fixed by: https://git.kernel.org/linus/8e9faa15469ed7c7467423db4c62aeed3ff4cae3

OS impact

Linux kernel Affected 8 releases

Version	Status	Fixed in
4.9.8	Affected	—
4.9.6	Affected	—
4.9.5	Affected	—
4.9.4	Affected	—
4.9.3	Affected	—
4.9.2	Affected	—
4.9.1	Affected	—
4.9	Affected	—

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`4.9.10-1`
sid	Fixed	`4.9.10-1`
forky	Fixed	`4.9.10-1`
bullseye	Fixed	`4.9.10-1`
bookworm	Fixed	`4.9.10-1`

References

CWEs

CWE-388

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.