CVE-2016-5344: Integer Overflow
First published: Tue Aug 30 2016(Updated: )
Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size value, related to mdss_compat_utils.c, mdss_fb.c, and mdss_rotator.c.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Android | ||
| Android | <=7.0 | |
| Linux kernel | >=3.0<=3.19.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/92695
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7
- https://www.codeaurora.org/integer-overflow-mdss-driver-cve-2016-5344
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=64e15c36d6c1c57dc2d95a3f163bc830a469fc20
- https://source.android.com/docs/security/bulletin/2016-10-01 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2016-5344?
CVE-2016-5344 has a severity rating that indicates potential denial of service vulnerabilities affecting Linux kernel versions from 3.0 to 3.19.8.
How do I fix CVE-2016-5344?
To fix CVE-2016-5344, update the Linux kernel to a version beyond 3.19.8 or upgrade your Android device to a version higher than 7.0.
Which devices are affected by CVE-2016-5344?
CVE-2016-5344 affects devices running Android versions up to and including 7.0 and Linux kernel versions from 3.0 to 3.19.8.
What type of attacks can CVE-2016-5344 enable?
CVE-2016-5344 can potentially enable attackers to cause a denial of service or have unspecified other impacts on the affected devices.
When was CVE-2016-5344 disclosed?
CVE-2016-5344 was disclosed as part of the security bulletin on October 1, 2016.
- agent/references
- agent/type
- agent/remedy
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/android-source
- source/Android
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/google
- canonical/android
- version/android/7.0
- vendor/linux
- canonical/linux kernel
- version/linux kernel/3.0
- version/linux kernel/3.19.8