CVE-2016-2544: Race Condition
ALSA sequencer code has an open race between the timer setup ioctl and the close of the client. This was triggered by syzkaller fuzzer, and a use-after-free was caught there as a result.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3567eb6af614dac436c4b16a8d426f9faed639b3
External references:
http://www.spinics.net/lists/alsa-devel/msg45102.html https://lkml.org/lkml/2016/1/12/465
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/133
http://seclists.org/oss-sec/2016/q1/410
Other sources
Race condition in the queuedelete function in sound/core/seq/seqqueue.c in the Linux kernel before 4.4.1 allows local users to cause a denial of service (use-after-free and system crash) by making an ioctl call at a certain time.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2016-2544.
What is the severity of CVE-2016-2544?
The severity of CVE-2016-2544 is low.
What is the affected software for CVE-2016-2544?
The affected software for CVE-2016-2544 is Linux kernel versions before 4.4.1.
How can the vulnerability CVE-2016-2544 be exploited?
The vulnerability CVE-2016-2544 can be exploited by local users to cause a denial of service by making an ioctl call at a certain time.
Is there a fix for CVE-2016-2544?
Yes, the vulnerability CVE-2016-2544 can be fixed by updating to Linux kernel version 4.4.1 or later.