PT-2016-2703 · Linux+1 · Linux Kernel+1
Published
2015-06-03
·
Updated
2020-08-03
·
CVE-2016-2065
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 3.x
Description
The issue is related to the sound/soc/msm/qdsp6v2/msm-audio-effects-q6-v2.c file in the MSM QDSP6 audio driver for the Linux kernel. It involves reading data beyond a specified buffer, which can be exploited by an attacker to cause a denial of service or potentially have other impacts, such as out-of-bounds writing and memory corruption. This can be achieved through a specially crafted application that makes an ioctl call, triggering the incorrect use of a parameters pointer, specifically the
parameters pointer.Recommendations
For Linux kernel version 3.x, consider restricting access to the vulnerable ioctl call until a patch is available. As a temporary workaround, avoid using the
parameters pointer in the affected ioctl call to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Memory Corruption
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linux Kernel