CVE-2016-2543

Published: 24 February 2016

The snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before 4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call.

From the Ubuntu security team

Dmitry Vyukov discovered that the Advanced Linux Sound Architecture (ALSA) framework did not verify that a FIFO was attached to a client before attempting to clear it. A local attacker could use this to cause a denial of service (system crash).

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Priority

Medium

CVSS 3 base score: 6.2

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2543
• http://www.openwall.com/lists/oss-security/2016/02/23/11
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=030e2c78d3a91dd0d27fef37e91950dde333eba1
• https://ubuntu.com/security/notices/USN-2931-1
• https://ubuntu.com/security/notices/USN-2932-1
• https://ubuntu.com/security/notices/USN-2929-2
• https://ubuntu.com/security/notices/USN-2929-1
• https://ubuntu.com/security/notices/USN-2930-1
• https://ubuntu.com/security/notices/USN-2930-3
• https://ubuntu.com/security/notices/USN-2930-2
• https://ubuntu.com/security/notices/USN-2967-2
• https://ubuntu.com/security/notices/USN-2967-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1549181