CVE-2016-2546: Race Condition
ALSA timer ioctls have an open race and this may lead to a use-after-free of timer instance object. A simplistic fix is to make each ioctl exclusive. We have already treadsem for controlling the tread, and extend this as a global mutex to be applied to each ioctl.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=af368027a49a751d6ff4ee9e3f9961f35bb4fede
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/133
http://seclists.org/oss-sec/2016/q1/410
Other sources
sound/core/timer.c in the Linux kernel before 4.4.1 uses an incorrect type of mutex, which allows local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2016-2546.
What is the severity of CVE-2016-2546?
The severity of CVE-2016-2546 is medium.
How does CVE-2016-2546 affect the Linux kernel?
CVE-2016-2546 allows local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call.
Which versions of the Linux kernel are affected by CVE-2016-2546?
Versions before 4.4.1 of the Linux kernel are affected by CVE-2016-2546.
How can I fix CVE-2016-2546?
To fix CVE-2016-2546, you should update your Linux kernel to version 4.4.1 or later.