CVE-2016-3951

Published: 2 May 2016

Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.

From the Ubuntu security team

Andrey Konovalov discovered that the CDC Network Control Model USB driver in the Linux kernel did not cancel work events queued if a later error occurred, resulting in a use-after-free. An attacker with physical access could use this to cause a denial of service (system crash).

Priority

Low

CVSS 3 base score: 4.6

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

requires physical proximity

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3951
• http://seclists.org/oss-sec/2016/q2/19
• https://www.spinics.net/lists/netdev/msg367669.html
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4d06dd537f95683aba3651098ae288b7cbff8274
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1666984c8625b3db19a9abc298931d35ab7bc64b
• https://ubuntu.com/security/notices/USN-2965-1
• https://ubuntu.com/security/notices/USN-2965-4
• https://ubuntu.com/security/notices/USN-2965-3
• https://ubuntu.com/security/notices/USN-2965-2
• https://ubuntu.com/security/notices/USN-2989-1
• https://ubuntu.com/security/notices/USN-2998-1
• https://ubuntu.com/security/notices/USN-3000-1
• https://ubuntu.com/security/notices/USN-3001-1
• https://ubuntu.com/security/notices/USN-3002-1
• https://ubuntu.com/security/notices/USN-3003-1
• https://ubuntu.com/security/notices/USN-3004-1
• https://ubuntu.com/security/notices/USN-3021-2
• https://ubuntu.com/security/notices/USN-3021-1
• NVD
• Launchpad
• Debian