PT-2016-4993 · Linux+1 · Linux Kernel+1

Publicado 2015-06-03 · Atualizado 2020-08-03 · CVE-2016-2062

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x

Description The issue is related to the adreno perfcounter query group function in the Adreno GPU driver, which uses an incorrect integer data type. This can be exploited by attackers to cause a denial of service, including integer overflow, heap-based buffer overflow, and incorrect memory allocation, via a crafted IOCTL KGSL PERFCOUNTER QUERY ioctl call.

Recommendations For Linux kernel version 3.x, consider disabling the adreno perfcounter query group function as a temporary workaround until a patch is available. Restrict access to the IOCTL KGSL PERFCOUNTER QUERY ioctl call to minimize the risk of exploitation.

Correção

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2015-1485

ALT-PU-2015-1849

CVE-2016-2062

Produtos afetados

Alt Linux

Linux Kernel

Referências · 6

• https://codeaurora.org/buffer-overflow-adreno-gpu-msm-driver-cve-2016-2062 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-2062 · Nota de Segurança
• https://codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=27c95b64b2e4b5ff1288cbaa6e353dd803d71576 · Correção
• http://source.android.com/security/bulletin/2016-06-01.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-2062 · Aviso do Fabricante
• http://securitytracker.com/id/1035766 · Nota