CVE-2016-2384: Double Free
A flaw was found in the USB-MIDI Linux kernel driver: a double-free error could be triggered for the 'umidi' object. An attacker with physical access to the system could use this flaw to escalate their privileges.
Other sources
Description:
A vulnerability was found in the Linux kernel. There is a possibility of double-free on 'umidi' object. The 'umidi' object will be free'd on the error path by sndusbmidifree() when tearing down the rawmidi interface causing the system panic.
Upstream report and fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07d86ca93db7e5cdf4743564d98292042ec21af7
External reference:
https://lkml.org/lkml/2016/2/13/11 http://seclists.org/oss-sec/2016/q1/331
CVE assignment:
http://seclists.org/oss-sec/2016/q1/334
— Red Hat
Double free vulnerability in the sndusbmidicreate function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-696.el6 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-514.rt56.420.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-514.el7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 07d86ca93db7e5cdf4743564d98292042ec21af7
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2016-2384?
CVE-2016-2384 is a double free vulnerability in the USB-MIDI Linux kernel driver that allows attackers to cause a denial of service or have other unspecified impact.
What is the severity of CVE-2016-2384?
CVE-2016-2384 has a high severity rating (7 out of 10).
How does CVE-2016-2384 affect Linux kernel versions?
CVE-2016-2384 affects Linux kernel versions before 4.5.
How can I fix the CVE-2016-2384 vulnerability?
To fix the CVE-2016-2384 vulnerability, update your Linux kernel to version 4.5 or later.
Where can I find more information about CVE-2016-2384?
You can find more information about CVE-2016-2384 at the following references: [Link 1](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07d86ca93db7e5cdf4743564d98292042ec21af7), [Link 2](https://lkml.org/lkml/2016/2/13/11), [Link 3](http://seclists.org/oss-sec/2016/q1/331).