CVE-2016-4569: Infoleak
A vulnerability was found in Linux kernel. There is an information leak in file "sound/core/timer.c" of the latest mainline Linux kernel, the stack object “tread” has a total size of 32 bytes. It contains a 8-bytes padding, which is not initialized but sent to user via copytouser(), resulting a kernel leak.
Other sources
A vulnerability was found in Linux kernel. There is an information leak in file sound/core/timer.c of the latest mainline Linux kernel, the stack object “tread” has a total size of 32 bytes. It contains a 8-bytes padding, which is not initialized but sent to user via copytouser, resulting a kernel leak.
External references:
http://comments.gmane.org/gmane.linux.kernel/2214250
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q2/279
http://seclists.org/oss-sec/2016/q2/296
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/tiwai/sound.git/commit/?h=for-next&id=cec8f96e49d9be372fdb0c3836dcf31ec71e457e
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cec8f96e49d9be372fdb0c3836dcf31ec71e457e
— Red Hat
The sndtimeruserparams function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-4569?
CVE-2016-4569 is classified with a medium severity level due to an information leak in the Linux kernel.
How do I fix CVE-2016-4569?
To fix CVE-2016-4569, update the Linux kernel to version 0:3.10.0-514.rt56.420.el7 or 0:3.10.0-514.el7 or later.
Which versions of Linux are affected by CVE-2016-4569?
CVE-2016-4569 affects various versions of the Linux kernel up to 4.6 and specific Ubuntu and SUSE distributions.
What causes the information leak in CVE-2016-4569?
The information leak in CVE-2016-4569 is caused by uninitialized padding bytes in the stack object 'tread' being sent to user space.
Is CVE-2016-4569 exploitable?
Yes, CVE-2016-4569 can be exploited for exposing sensitive information due to the uninitialized data being leaked.