CVE-2019-15217

What it actually does

NULL pointer dereference in the zr364xx USB video driver triggered by a malicious device, resulting in kernel panic and denial of service.

Why it matters to the business

A physically present attacker can crash affected Linux systems by connecting a crafted USB device, causing unplanned downtime on systems that still use the zr364xx driver; risk is low due to physical-access requirement and the flaw's age.

How an attack unfolds

An attacker with physical access crafts a USB device that, when connected, causes the zr364xx driver to dereference a NULL pointer during initialization, immediately panicking the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 5d2e73a5f80a5b5aff3caf1ec6d39b5b3f54b26e or later; disable or remove the zr364xx driver module if the hardware is not required.

How to confirm the fix worked

Confirm the running kernel contains commit 5d2e73a5f80a5b5aff3caf1ec6d39b5b3f54b26e or a later equivalent; verify absence of the zr364xx module or test with a non-malicious zr364xx device.

Typical attack path

1. Gain physical access to the target system
2. Connect a maliciously crafted USB device recognized by the zr364xx driver
3. Trigger NULL pointer dereference during device probe
4. Cause kernel panic and system reboot or halt

How to detect it

Review kernel logs for zr364xx-related NULL pointer dereference panics or oops messages around the time of unexpected USB device insertion; correlate with physical access logs.

• kernel: zr364xx
• NULL pointer dereference
• usb 1-1: zr364xx

What your security team should do

• Apply the referenced kernel commit or newer release on all systems exposing the zr364xx driver
• Audit for legacy zr364xx hardware and replace with supported devices where possible
• Restrict physical USB ports or enforce USB device allow-listing on exposed systems