PT-2016-6028 · Linux+2 · Linux Kernel+2

Andrej Nemec · Published 2016-05-10 · Updated 2023-01-18 · CVE-2016-4568

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.5.3

Description The issue allows local users to cause a denial of service, specifically a kernel memory write operation, or possibly have other unspecified impacts. This is achieved via a crafted number of planes in a VIDIOC DQBUF ioctl call, targeting the videobuf2-v4l2.c file in the Linux kernel.

Recommendations For Linux kernel versions prior to 4.5.3, update to version 4.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the VIDIOC DQBUF ioctl call to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2016-1470

CVE-2016-4568

USN-3161-1

USN-3161-2

USN-3161-3

USN-3161-4

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 35

• https://github.com/torvalds/linux/commit/2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab · Vendor Advisory
• https://osv.dev/vulnerability/USN-3161-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-4568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8964 · Vendor Advisory
• http://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.3 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3161-4 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4568 · Security Note
• https://ubuntu.com/security/CVE-2016-9178 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4568 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7097 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3161-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8633 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3161-4 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3161-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-9555 · Vendor Advisory