CVE-2015-7515

What it actually does

NULL pointer dereference in aiptek_probe when processing a USB device lacking endpoints, resulting in kernel panic.

Why it matters to the business

An attacker with physical access can crash affected systems, causing downtime on machines that accept USB input devices.

How an attack unfolds

An attacker creates a USB device that reports no endpoints, connects it to a vulnerable system, and triggers the aiptek driver probe routine which dereferences a NULL pointer and crashes the kernel.

How to fix it

Upgrade the Linux kernel to version 4.4 or later; disable the aiptek driver module if the hardware is not required.

How to confirm the fix worked

Verify the running kernel version is 4.4 or newer and confirm the aiptek module is either absent or updated; test with a non-endpoint USB device in a lab environment to ensure no crash occurs.

Typical attack path

1. Craft a USB device descriptor with zero endpoints
2. Physically connect the device to a target system running a vulnerable kernel
3. Allow the aiptek driver to enumerate and call aiptek_probe
4. Trigger NULL dereference and kernel panic

How to detect it

Review kernel crash logs and dmesg output for aiptek_probe NULL pointer dereference entries around the time of unexpected reboots; correlate with physical access logs.

• aiptek_probe
• NULL pointer dereference
• usb 1-1: new device

What your security team should do

• Apply kernel updates to 4.4+ across all affected hosts
• Restrict physical USB access where possible using port locks or policy
• Blacklist the aiptek module on systems that do not require it