PT-2016-4997 · Linux+1 · Linux Kernel+1

Publicado 2015-06-03 · Atualizado 2020-07-31 · CVE-2016-2068

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x

Description The issue allows attackers to gain privileges or cause a denial of service via a crafted application. This can be achieved by performing either an AUDIO EFFECTS WRITE or AUDIO EFFECTS READ operation. The exploitation is possible due to integer overflow and buffer overflow or buffer over-read in the MSM QDSP6 audio driver.

Recommendations For Linux kernel version 3.x, consider restricting access to the AUDIO EFFECTS WRITE and AUDIO EFFECTS READ operations until a patch is available. As a temporary workaround, disabling the vulnerable MSM QDSP6 audio driver may help minimize the risk of exploitation.

Correção

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2015-1485

ALT-PU-2015-1849

CVE-2016-2068

Produtos afetados

Alt Linux

Linux Kernel

Referências · 10

• https://codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2068-0 · Nota
• https://ubuntu.com/security/CVE-2016-2068 · Aviso do Fabricante
• http://source.android.com/security/bulletin/2016-07-01.html · Aviso do Fabricante
• https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=9900650540c889f761d102202bc80306ae80ab83 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2016-2068 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2068 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-2068 · Nota de Segurança
• https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=2c04c0dab66013b7dfbe4d5a523c2c1d6b5b11d6 · Correção
• https://osv.dev/vulnerability/CVE-2016-2068 · Aviso do Fabricante
• https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=01ee86da5a0cd788f134e360e2be517ef52b6b00 · Correção