CVE-2016-2184
Linux Kernel 3.10.0-229.x (CentOS / RHEL 7.1) - 'snd-usb-audio' Crash (PoC)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel before 4.5.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor.
La función create_fixed_stream_quirk en sound/usb/quirks.c en el controlador snd-usb-audio en el kernel de Linux en versiones anteriores a 4.5.1 permite a atacantes físicamente próximos provocar una denegación de servicio (referencia a puntero NULL o doble libre y caída de sistema) a través de un valor de dispositivo final manipulado en un dispositivo USB descriptor.
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the Linux kernel did not properly sanity check the endpoints reported by the device. An attacker with physical access could cause a denial of service (system crash). Ben Hawkes discovered that the Linux kernel's AIO interface allowed single writes greater than 2GB, which could cause an integer overflow when writing to certain filesystems, socket or device types. A local attacker could this to cause a denial of service (system crash) or possibly execute arbitrary code. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-01-29 CVE Reserved
- 2016-03-12 CVE Published
- 2016-03-12 First Exploit
- 2024-08-05 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (28)
| URL | Tag | Source |
|---|---|---|
| http://seclists.org/bugtraq/2016/Mar/102 | Mailing List |
|
| http://seclists.org/bugtraq/2016/Mar/88 | Mailing List |
|
| http://seclists.org/bugtraq/2016/Mar/89 | Mailing List |
|
| http://www.securityfocus.com/bid/84340 | Vdb Entry | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1317012 | Issue Tracking | |
| https://source.android.com/security/bulletin/2016-11-01.html | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| https://packetstorm.news/files/id/136221 | 2016-03-12 | |
| https://www.exploit-db.com/exploits/39555 | 2024-08-05 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | <= 4.5.0 Search vendor "Linux" for product "Linux Kernel" and version " <= 4.5.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | lts |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Software Development Kit Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" and version "11.0" | sp4 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Software Development Kit Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Debuginfo Search vendor "Novell" for product "Suse Linux Enterprise Debuginfo" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Debuginfo" and version "11.0" | sp4 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Desktop Search vendor "Novell" for product "Suse Linux Enterprise Desktop" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Desktop" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Live Patching Search vendor "Novell" for product "Suse Linux Enterprise Live Patching" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Live Patching" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Module For Public Cloud Search vendor "Novell" for product "Suse Linux Enterprise Module For Public Cloud" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Module For Public Cloud" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Real Time Extension Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" and version "11.0" | sp4 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Real Time Extension Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" and version "12.0" | sp1 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "11.0" | extra |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "11.0" | sp4 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Workstation Extension Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" and version "12.0" | - |
Affected
| ||||||