CVE-2016-2547: Race Condition
A slave timer instance might be still accessible in a racy way while operating the master instance as it lacks of locking. Since the master operation is mostly protected with timer->lock, we should cope with it while changing the slave instance, too.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b5a663aa426f4884c71cd8580adae73f33570f0d
External references:
http://marc.info/?l=linux-kernel&m=145269654327048 https://gist.githubusercontent.com/dvyukov/e833610757b098956b50/raw/d819cd13b466e4adbe3dd825ee481e4512e77633/gistfile1.txt
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/133
http://seclists.org/oss-sec/2016/q1/410
Other sources
sound/core/timer.c in the Linux kernel before 4.4.1 employs a locking approach that does not consider slave timer instances, which allows local users to cause a denial of service (race condition, use-after-free, and system crash) via a crafted ioctl call.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-2547.
What is the severity level of CVE-2016-2547?
The severity level of CVE-2016-2547 is medium with a value of 4.
What software versions are affected by CVE-2016-2547?
The affected software versions are Linux kernel versions before 4.4.1.
How can this vulnerability be exploited?
This vulnerability can be exploited by local users through a crafted ioctl call, which can lead to a denial of service, race condition, use-after-free, and system crash.
Is there a fix available for CVE-2016-2547?
Yes, a fix is available in Linux kernel version 4.4.1 and later.