CVE-2016-2549

Published: 24 February 2016

sound/core/hrtimer.c in the Linux kernel before 4.4.1 does not prevent recursive callback access, which allows local users to cause a denial of service (deadlock) via a crafted ioctl call. However, the previous fix is still insufficient: it may still cause a lockup when the ALSA timer instance reprograms itself in its callback. Then it invokes the start function even in snd_timer_interrupt() that is called in hrtimer callback itself, results in a CPU stall. This is no hypothetical problem but actually triggered by syzkaller fuzzer.

From the Ubuntu Security Team

Dmitry Vyukov discovered that the Advanced Linux Sound Architecture (ALSA) framework's handling of high resolution timers could lead to a deadlock condition. A local attacker could use this to cause a denial of service (system hang).

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2549
• http://www.openwall.com/lists/oss-security/2016/02/23/11
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2ba1fe7a06d3624f9a7586d672b55f08f7c670f3
• https://ubuntu.com/security/notices/USN-2931-1
• https://ubuntu.com/security/notices/USN-2932-1
• https://ubuntu.com/security/notices/USN-2929-2
• https://ubuntu.com/security/notices/USN-2929-1
• https://ubuntu.com/security/notices/USN-2930-3
• https://ubuntu.com/security/notices/USN-2930-1
• https://ubuntu.com/security/notices/USN-2930-2
• https://ubuntu.com/security/notices/USN-2967-2
• https://ubuntu.com/security/notices/USN-2967-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1549200