CVE-2016-3951: Double Free

Published Apr 7, 2016

Updated

A vulnerability was found in the usbnet Linux kernel driver.

The bug allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have other impact by inserting a USB device with an invalid USB descriptor.

Upstream fixes:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4d06dd537f95683aba3651098ae288b7cbff8274 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1666984c8625b3db19a9abc298931d35ab7bc64b

External references:

https://www.spinics.net/lists/netdev/msg367669.html https://bugzilla.novell.com/showbug.cgi?id=974418

Reference and CVE assignment:

http://seclists.org/oss-sec/2016/q2/19

Other sources

Double free vulnerability in drivers/net/usb/cdcncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.

— Launchpad

Affected Software

17 affected componentsFixes available

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Canonical Ubuntu Linux=15.10

Novell Suse Linux Enterprise Software Development Kit=12.0-sp1

SUSE Suse Linux Enterprise Software Development Kit=12.0

Novell Suse Linux Enterprise Desktop=12

Novell Suse Linux Enterprise Desktop=12-sp1

Novell Suse Linux Enterprise Live Patching=12.0

Novell Suse Linux Enterprise Module For Public Cloud=12

Novell Suse Linux Enterprise Real Time Extension=12-sp1

Novell Suse Linux Enterprise Server=12.0

Novell Suse Linux Enterprise Server=12.0-sp1

Novell Suse Linux Enterprise Workstation Extension=12.0

Novell Suse Linux Enterprise Workstation Extension=12.0-sp1

Linux Linux kernel=4.5.0-rc7

debian/linux

5.10.223-15.10.234-16.1.129-16.1.135-16.12.22-16.12.25-1

Google Android

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Fixed in 4.5

Event History

Apr 7, 2016

Data Sourced

via Red Hat·09:41 AM

DescriptionSeverityAffected Software

May 2, 2016

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Sep 6, 2016

Data Sourced

via Android·12:00 AM

SeverityAffected Software

Frequently Asked Questions

What is the vulnerability ID for this double free vulnerability?

The vulnerability ID for this double free vulnerability is CVE-2016-3951.

What is the severity of CVE-2016-3951?

The severity of CVE-2016-3951 is low.

How does CVE-2016-3951 affect Linux kernel versions?

CVE-2016-3951 affects Linux kernel versions before 4.5.

What is the impact of CVE-2016-3951?

The impact of CVE-2016-3951 is a denial of service (system crash) or possibly unspecified other impact by inserting a USB device with an invalid USB descriptor.

How can I fix CVE-2016-3951?

To fix CVE-2016-3951, update your Linux kernel to version 4.5 or later.

CVE-2016-3951: Double Free

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the vulnerability ID for this double free vulnerability?

What is the severity of CVE-2016-3951?

How does CVE-2016-3951 affect Linux kernel versions?

What is the impact of CVE-2016-3951?

How can I fix CVE-2016-3951?

Company

Resources

Contact