CVE-2017-17975

What it actually does

Use-after-free in usbtv_probe allows a kfree of the usbtv structure during usbtv_video_free while the failure path still accesses and frees the same structure after audio registration failure.

Why it matters to the business

Local users can trigger kernel crashes on systems exposing the affected USB video driver, leading to denial of service and potential loss of availability; the issue is old with negligible exploitation probability.

How an attack unfolds

An attacker with local access connects a USB TV device and forces audio registration to fail, causing the driver to free the usbtv object and then dereference it again on the failure label path.

How to fix it

Upgrade affected packages to the listed fixed versions: mariadb-5.5 on Ubuntu 14.04 to 5.5.46-1ubuntu0.14.04.2 and mysql-5.6 on Ubuntu 14.04 to 5.6.27-0ubuntu0.14.04.1.

How to confirm the fix worked

Verify package versions match the fixed releases and confirm the usbtv-core.c driver no longer contains the double-free sequence on the failure path.

Typical attack path

1. Obtain local user access on a system with the vulnerable kernel driver loaded
2. Attach a USB TV device that triggers usbtv_probe
3. Induce audio registration failure to reach the usbtv_video_fail path
4. Trigger the double-free and subsequent use-after-free to crash the kernel

How to detect it

Review kernel logs for usbtv_probe and usbtv_video_free call traces ending in oops or panic; search audit logs for unexpected USB device attachments followed by crashes.

What your security team should do

• Apply the specified package updates on all Ubuntu 14.04 systems running mariadb-5.5 or mysql-5.6
• Disable the usbtv driver module if USB TV hardware is not required
• Monitor for local privilege-escalation attempts while patches are deployed