PT-2016-4997 · Linux+1 · Linux Kernel+1

Published 2015-06-03 · Updated 2020-07-31 · CVE-2016-2068

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x

Description The issue allows attackers to gain privileges or cause a denial of service via a crafted application. This can be achieved by performing either an AUDIO EFFECTS WRITE or AUDIO EFFECTS READ operation. The exploitation is possible due to integer overflow and buffer overflow or buffer over-read in the MSM QDSP6 audio driver.

Recommendations For Linux kernel version 3.x, consider restricting access to the AUDIO EFFECTS WRITE and AUDIO EFFECTS READ operations until a patch is available. As a temporary workaround, disabling the vulnerable MSM QDSP6 audio driver may help minimize the risk of exploitation.

Fix

DoS

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2015-1485

ALT-PU-2015-1849

CVE-2016-2068

Affected Products

Alt Linux

Linux Kernel

References · 10

• https://ubuntu.com/security/CVE-2016-2068 · Vendor Advisory
• http://source.android.com/security/bulletin/2016-07-01.html · Vendor Advisory
• https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=9900650540c889f761d102202bc80306ae80ab83 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-2068 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2068 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2068 · Security Note
• https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=2c04c0dab66013b7dfbe4d5a523c2c1d6b5b11d6 · Patch
• https://osv.dev/vulnerability/CVE-2016-2068 · Vendor Advisory
• https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=01ee86da5a0cd788f134e360e2be517ef52b6b00 · Patch
• https://codeaurora.org/multiple-vulnerabilities-msm-qdsp6-audio-driver-allow-kernel-memory-corruption-cve-2016-2068-0 · Note