CVE-2015-7566

What it actually does

The flaw triggers a NULL pointer dereference in clie_5_attach when a USB device lacking a bulk-out endpoint is attached, causing a kernel crash.

Why it matters to the business

Systems can be crashed by anyone with brief physical access to a USB port, leading to unplanned downtime on servers, workstations, or embedded devices running affected kernels.

How an attack unfolds

An attacker with physical access crafts or selects a USB device that omits the bulk-out endpoint, inserts it into the target system, and the visor driver’s clie_5_attach function dereferences a NULL pointer, crashing the kernel. Public exploit code has been available for years.

How to fix it

Upgrade the Linux kernel to a version later than 4.4.1 that contains the fix for the visor driver; restrict physical USB access via port locks or policy where upgrades are delayed.

How to confirm the fix worked

Verify the running kernel version is newer than 4.4.1 and confirm the visor.c driver no longer contains the vulnerable clie_5_attach logic; test insertion of a non-bulk-out USB device in a lab environment and ensure no crash occurs.

Typical attack path

1. Obtain brief physical access to a target machine’s USB ports
2. Prepare or obtain a USB device missing a bulk-out endpoint
3. Insert the device to trigger clie_5_attach
4. Observe kernel panic and system reboot or halt

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for NULL pointer dereference panics occurring immediately after USB device insertion events; correlate with USB device addition timestamps in syslog or udev logs.

• clie_5_attach
• visor.c
• usb serial NULL pointer dereference
• usb 1-*: USB disconnect, device number

What your security team should do

• Apply the kernel update immediately on all exposed systems
• Disable unnecessary USB serial drivers via kernel configuration or blacklisting where feasible
• Enforce physical security controls on USB ports for high-value assets
• Monitor for kernel oops or panic events referencing visor or usb-serial