CVE-2016-3951

Published: 02 May 2016

Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.

From the Ubuntu security team

Andrey Konovalov discovered that the CDC Network Control Model USB driver in the Linux kernel did not cancel work events queued if a later error occurred, resulting in a use-after-free. An attacker with physical access could use this to cause a denial of service (system crash).

Priority

CVSS 3 base score: 4.6

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







	Patches: Introduced by 8a34b0ae8778f6b42ed38857486b769a224e2536 Fixed by 4d06dd537f95683aba3651098ae288b7cbff8274 Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Fixed by 1666984c8625b3db19a9abc298931d35ab7bc64b
linux-armadaxp Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







	This package is not directly supported by the Ubuntu Security Team
linux-aws Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-flo Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-gke Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-goldfish Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-grouper Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-hwe Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-hwe-edge Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-linaro-omap Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-linaro-shared Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-linaro-vexpress Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-lts-quantal Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







	This package is not directly supported by the Ubuntu Security Team
linux-lts-raring Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-lts-saucy Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







	This package is not directly supported by the Ubuntu Security Team
linux-lts-trusty Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-lts-utopic Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-lts-vivid Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-lts-wily Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-lts-xenial Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-maguro Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-mako Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-manta Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-qcm-msm Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-raspi2 Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-snapdragon Launchpad, Ubuntu, Debian	Upstream	Released (4.5)







linux-ti-omap4 Launchpad, Ubuntu, Debian	Upstream	Released (4.5)

Notes

Author	Note
jdstrand	android kernels (flo, goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 14.10 and earlier preview kernels linux-lts-saucy no longer receives official support linux-lts-quantal no longer receives official support
sbeattie	requires physical proximity

Author

Note

jdstrand

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

sbeattie

requires physical proximity

References

Bugs

https://launchpad.net/bugs/1567191

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›