PT-2016-4993 · Linux+1 · Linux Kernel+1

Published 2015-06-03 · Updated 2020-08-03 · CVE-2016-2062

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x

Description The issue is related to the adreno perfcounter query group function in the Adreno GPU driver, which uses an incorrect integer data type. This can be exploited by attackers to cause a denial of service, including integer overflow, heap-based buffer overflow, and incorrect memory allocation, via a crafted IOCTL KGSL PERFCOUNTER QUERY ioctl call.

Recommendations For Linux kernel version 3.x, consider disabling the adreno perfcounter query group function as a temporary workaround until a patch is available. Restrict access to the IOCTL KGSL PERFCOUNTER QUERY ioctl call to minimize the risk of exploitation.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2015-1485

ALT-PU-2015-1849

CVE-2016-2062

Affected Products

Alt Linux

Linux Kernel

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-2062 · Security Note
• https://codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=27c95b64b2e4b5ff1288cbaa6e353dd803d71576 · Patch
• http://source.android.com/security/bulletin/2016-06-01.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-2062 · Vendor Advisory
• https://codeaurora.org/buffer-overflow-adreno-gpu-msm-driver-cve-2016-2062 · Note
• http://securitytracker.com/id/1035766 · Note