CVE-2016-2384: Double Free
A flaw was found in the USB-MIDI Linux kernel driver: a double-free error could be triggered for the 'umidi' object. An attacker with physical access to the system could use this flaw to escalate their privileges.
Other sources
Description:
A vulnerability was found in the Linux kernel. There is a possibility of double-free on 'umidi' object. The 'umidi' object will be free'd on the error path by sndusbmidifree() when tearing down the rawmidi interface causing the system panic.
Upstream report and fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07d86ca93db7e5cdf4743564d98292042ec21af7
External reference:
https://lkml.org/lkml/2016/2/13/11 http://seclists.org/oss-sec/2016/q1/331
CVE assignment:
http://seclists.org/oss-sec/2016/q1/334
— Red Hat
Double free vulnerability in the sndusbmidicreate function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2016-2384?
CVE-2016-2384 is a double free vulnerability in the USB-MIDI Linux kernel driver that allows attackers to cause a denial of service or have other unspecified impact.
What is the severity of CVE-2016-2384?
CVE-2016-2384 has a high severity rating (7 out of 10).
How does CVE-2016-2384 affect Linux kernel versions?
CVE-2016-2384 affects Linux kernel versions before 4.5.
How can I fix the CVE-2016-2384 vulnerability?
To fix the CVE-2016-2384 vulnerability, update your Linux kernel to version 4.5 or later.
Where can I find more information about CVE-2016-2384?
You can find more information about CVE-2016-2384 at the following references: [Link 1](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07d86ca93db7e5cdf4743564d98292042ec21af7), [Link 2](https://lkml.org/lkml/2016/2/13/11), [Link 3](http://seclists.org/oss-sec/2016/q1/331).