CVE-2016-2548: Input Validation
Last updated 24 July 2024
Other sources
Some linked lists (activelist and acklist) of slave instances aren't unlinked immediately at stopping or closing, and this may lead to unexpected accesses.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b5a663aa426f4884c71cd8580adae73f33570f0d
External references:
http://seclists.org/oss-sec/2016/q1/133
— Red Hat
sound/core/timer.c in the Linux kernel before 4.4.1 retains certain linked lists after a close or stop action, which allows local users to cause a denial of service (system crash) via a crafted ioctl call, related to the (1) sndtimerclose and (2) sndtimerstop functions.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-2548?
CVE-2016-2548 is a vulnerability in the Linux kernel that allows local users to cause a denial of service (system crash) via a crafted ioctl call.
How severe is CVE-2016-2548?
CVE-2016-2548 has a severity level of medium.
Which Linux kernel versions are affected by CVE-2016-2548?
Linux kernel versions before 4.4.1 are affected by CVE-2016-2548.
How can I fix CVE-2016-2548?
To fix CVE-2016-2548, you should update your Linux kernel to version 4.4.1 or later.
Where can I find more information about CVE-2016-2548?
You can find more information about CVE-2016-2548 on the Openwall website and the Linux kernel git repository.