PT-2016-7427 · Linux+1 · Linux Kernel+1

Published 2016-05-10 · Updated 2023-01-19 · CVE-2016-7912

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.5.3

Description A use-after-free issue exists in the ffs user copy worker function, located in drivers/usb/gadget/function/f fs.c, allowing local users to gain privileges by accessing an I/O data structure after a certain callback call.

Recommendations For versions prior to 4.5.3, update to version 4.5.3 or later to resolve the issue.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2016-1470

ALT-PU-2016-1485

CVE-2016-7912

Affected Products

Alt Linux

Linux Kernel

References · 12

• https://github.com/torvalds/linux/commit/38740a5b87d53ceb89eb2c970150f6e94e00373a · Patch
• https://cve.org/CVERecord?id=CVE-2016-7912 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-7912 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7912 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-7912 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7912 · Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=38740a5b87d53ceb89eb2c970150f6e94e00373a · Patch
• http://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7912 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7912 · Vendor Advisory
• http://securityfocus.com/bid/94197 · Note
• http://source.android.com/security/bulletin/2016-11-01.html · Note