CVE-2016-4568: Buffer Overflow
drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a crafted number of planes in a VIDIOCDQBUF ioctl call.
Other sources
When a buffer is being dequeued using VIDIOCDQBUF IOCTL, the exact buffer which will be dequeued is not known until the buffer has been removed from the queue. The number of planes is specific to a buffer, not to the queue. This does lead to the situation where multi-plane buffers may be requested and queued with n planes, but VIDIOCDQBUF IOCTL may be passed an argument struct with fewer planes. fillv4l2buffer() however uses the number of planes from the dequeued videobuf2 buffer, overwriting kernel memory (the m.planes array allocated in videousercopy() in v4l2-ioctl.c) if the user provided fewer planes than the dequeued buffer had.
References:
http://seclists.org/oss-sec/2016/q2/272
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab
Introduced by:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b0e0e1f83de31aa0428c38b692c590cc0ecd3f03
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-4568?
CVE-2016-4568 is a vulnerability in the Linux kernel that allows local users to cause a denial of service or possibly have other impacts.
How does CVE-2016-4568 affect the Linux kernel?
CVE-2016-4568 affects the Linux kernel before version 4.5.3.
What is the severity of CVE-2016-4568?
CVE-2016-4568 has a severity level of low.
How can I fix CVE-2016-4568?
To fix CVE-2016-4568, update your Linux kernel to version 4.5.3 or later.
Where can I find more information about CVE-2016-4568?
You can find more information about CVE-2016-4568 at the following references: [link1], [link2], [link3].