Vulnerability CVE-2016-4578


Published: 2016-05-23

Description:
sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.

Type:

CWE-200

(Information Exposure)

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.1/10
2.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Redhat -> Enterprise linux server eus 
Redhat -> Enterprise linux server tus 
Redhat -> Enterprise linux workstation 
Redhat -> Enterprise linux desktop 
Redhat -> Enterprise linux server 
Redhat -> Enterprise linux server aus 
Opensuse -> LEAP 
Opensuse -> Opensuse 
Novell -> Suse linux enterprise debuginfo 
Novell -> Suse linux enterprise desktop 
Novell -> Suse linux enterprise live patching 
Novell -> Suse linux enterprise module for public cloud 
Novell -> Suse linux enterprise real time extension 
Novell -> Suse linux enterprise server 
Novell -> Suse linux enterprise software development kit 
Novell -> Suse linux enterprise workstation extension 
Linux -> Linux kernel 
Debian -> Debian linux 
Canonical -> Ubuntu linux 

 References:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4ec8cc8039a7063e24204299b462bd1383184a5
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html
http://rhn.redhat.com/errata/RHSA-2016-2574.html
http://rhn.redhat.com/errata/RHSA-2016-2584.html
http://www.debian.org/security/2016/dsa-3607
http://www.openwall.com/lists/oss-security/2016/05/11/5
http://www.securityfocus.com/bid/90535
http://www.ubuntu.com/usn/USN-3016-1
http://www.ubuntu.com/usn/USN-3016-2
http://www.ubuntu.com/usn/USN-3016-3
http://www.ubuntu.com/usn/USN-3016-4
http://www.ubuntu.com/usn/USN-3017-1
http://www.ubuntu.com/usn/USN-3017-2
http://www.ubuntu.com/usn/USN-3017-3
http://www.ubuntu.com/usn/USN-3018-1
http://www.ubuntu.com/usn/USN-3018-2
http://www.ubuntu.com/usn/USN-3019-1
http://www.ubuntu.com/usn/USN-3020-1
http://www.ubuntu.com/usn/USN-3021-1
http://www.ubuntu.com/usn/USN-3021-2
https://bugzilla.redhat.com/show_bug.cgi?id=1335215
https://github.com/torvalds/linux/commit/9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6
https://github.com/torvalds/linux/commit/e4ec8cc8039a7063e24204299b462bd1383184a5
https://www.exploit-db.com/exploits/46529/

Copyright 2020, cxsecurity.com

 

Back to Top