CVE-2016-2543: Null Pointer Dereference
A null dereference vulnerability was found in the Linux kernel. Function sndseqioctlremoveevents() calls sndseqfifoclear() unconditionally even if there is no FIFO assigned, and this leads to an Oops due to NULL dereference. The fix is just to add a proper NULL check.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=030e2c78d3a91dd0d27fef37e91950dde333eba1
External references:
https://lkml.org/lkml/2016/1/12/215
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/133
http://seclists.org/oss-sec/2016/q1/410
Other sources
The sndseqioctlremoveevents function in sound/core/seq/seqclientmgr.c in the Linux kernel before 4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-2543?
CVE-2016-2543 is a vulnerability in the Linux kernel that allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call.
How does CVE-2016-2543 affect the Linux kernel?
CVE-2016-2543 affects the snd_seq_ioctl_remove_events function in sound/core/seq/seq_clientmgr.c in the Linux kernel before version 4.4.1.
What is the severity of CVE-2016-2543?
CVE-2016-2543 has a severity level of low.
How can I fix CVE-2016-2543?
To fix CVE-2016-2543, update your Linux kernel to version 4.4.1 or higher.
Where can I find more information about CVE-2016-2543?
You can find more information about CVE-2016-2543 at the following references: [Reference 1](http://www.openwall.com/lists/oss-security/2016/01/19/1), [Reference 2](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=030e2c78d3a91dd0d27fef37e91950dde333eba1), [Reference 3](http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1).