CVE-2016-2545: Race Condition
ALSA timer instance object has a couple of linked lists and they are unlinked unconditionally at sndtimerstop(). Meanwhile sndtimerinterrupt() unlinks it, but it calls listdel() which leaves the element list itself unchanged. This ends up with unlinking twice, and it was caught by syzkaller fuzzer.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee8413b01045c74340aa13ad5bdf905de32be736
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/133
http://seclists.org/oss-sec/2016/q1/410
Other sources
The sndtimerinterrupt function in sound/core/timer.c in the Linux kernel before 4.4.1 does not properly maintain a certain linked list, which allows local users to cause a denial of service (race condition and system crash) via a crafted ioctl call.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2545?
The severity of CVE-2016-2545 is low.
How does CVE-2016-2545 affect Linux kernel?
CVE-2016-2545 affects the snd_timer_interrupt function in sound/core/timer.c in the Linux kernel before version 4.4.1.
What is the impact of CVE-2016-2545?
The impact of CVE-2016-2545 is a denial of service (race condition and system crash) caused by a crafted ioctl call.
How can I fix CVE-2016-2545?
To fix CVE-2016-2545, update the Linux kernel to version 4.4.1 or later.
Where can I find more information about CVE-2016-2545?
You can find more information about CVE-2016-2545 on the following references: [1] [2] [3]