CVE-2016-4578

MEDIUM

Linux Kernel < 4.6 - Information Disclosure

Title source: rule

Description

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.

Exploits (1)

exploitdb WORKING POC

by wally0813 · cdoslinux

https://www.exploit-db.com/exploits/46529

View Code ZIP pw:eip

References (31)

[Third Party Advisory] http://www.ubuntu.com/usn/USN-3016-3

[Vendor Advisory] http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6

[Vendor Advisory] http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4ec8cc8039a7063e24204299b462bd1383184a5

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html

[Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2016-2574.html

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2016-2584.html

[Third Party Advisory] http://www.debian.org/security/2016/dsa-3607

[Mailing List] http://www.openwall.com/lists/oss-security/2016/05/11/5

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/90535

[Third Party Advisory] http://www.ubuntu.com/usn/USN-3016-1

[Third Party Advisory] http://www.ubuntu.com/usn/USN-3016-2

[Third Party Advisory] http://www.ubuntu.com/usn/USN-3016-4

[Third Party Advisory] http://www.ubuntu.com/usn/USN-3017-1

[Third Party Advisory] http://www.ubuntu.com/usn/USN-3017-2

... and 11 more

Scores

CVSS v3 5.5

EPSS 0.0013

EPSS Percentile 32.4%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status draft

Affected Products (20)

linux/linux_kernel < 4.6

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

debian/debian_linux

redhat/enterprise_linux_desktop

redhat/enterprise_linux_server

redhat/enterprise_linux_server_aus

redhat/enterprise_linux_server_aus

redhat/enterprise_linux_server_aus

redhat/enterprise_linux_server_eus

redhat/enterprise_linux_server_eus

redhat/enterprise_linux_server_eus

redhat/enterprise_linux_server_eus

... and 5 more

Timeline

Published May 23, 2016

Tracked Since Feb 18, 2026