PT-2016-6409 · Linux+2 · Linux Kernel+2

James Patrick-Evans · Published 2016-08-06 · Updated 2017-09-01 · CVE-2016-5400

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.7

Description The issue is related to a memory leak in the airspy probe function in the airspy USB driver. This leak allows local users to cause a denial of service by consuming memory. The denial of service can be triggered through a crafted USB device that emulates many devices of type VFL TYPE SDR or VFL TYPE SUBDEV and performs many connect and disconnect operations.

Recommendations For Linux kernel versions prior to 4.7, update to version 4.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of USB devices that emulate many VFL TYPE SDR or VFL TYPE SUBDEV devices to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2016-1853

ALT-PU-2017-1330

CVE-2016-5400

MGASA-2016-0345

MGASA-2016-0364

USN-3070-1

USN-3070-2

USN-3070-3

USN-3070-4

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 49

• https://github.com/torvalds/linux/commit/aa93d1fee85c890a34f2510a310e55ee76a27848 · Patch
• http://ubuntu.com/usn/USN-3070-3 · Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa93d1fee85c890a34f2510a310e55ee76a27848 · Patch
• https://security-tracker.debian.org/tracker/CVE-2016-5400 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5828 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5696 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3070-4 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5728 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3070-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3070-3 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5400 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0364 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5400 · Security Note
• https://ubuntu.com/security/notices/USN-3070-3 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5400 · Vendor Advisory