CVE-2007-5093

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-09-26 · updated 2026-06-16
Weakness: CWE-399

Description

The disconnect method in the Philips USB Webcam (pwc) driver in Linux kernel 2.6.x before 2.6.22.6 "relies on user space to close the device," which allows user-assisted local attackers to cause a denial of service (USB subsystem hang and CPU consumption in khubd) by not closing the device after the disconnect is invoked. NOTE: this rarely crosses privilege boundaries, unless the attacker can convince the victim to unplug the affected device.

Affected products

Linux kernel: 2.6.0, 2.6.0-test1, 2.6.0-test10, 2.6.0-test11, 2.6.0-test2, 2.6.0-test3 (+185)

References

http://marc.info/?l=linux-kernel&m=118873457814808&w=2
http://marc.info/?l=linux-kernel&m=118880154122548&w=2
http://rhn.redhat.com/errata/RHSA-2008-0972.html
http://secunia.com/advisories/26994
http://secunia.com/advisories/28170
http://secunia.com/advisories/28706
http://secunia.com/advisories/28971
http://secunia.com/advisories/29058
http://secunia.com/advisories/30294
http://secunia.com/advisories/32799
http://www.debian.org/security/2007/dsa-1381
http://www.debian.org/security/2008/dsa-1503

Get alerted when CVE-2007-5093 or the next vulnerability affects your stack