CVE-2016-5829: Buffer Overflow
A vulnerabilty was found in the Linux kernels hiddev driver. An attacker with permissions to the USB HID device can call an ioctl with the HIDIOCGUSAGES or HIDIOCSUSAGES command, and passes a report id of HIDREPORTIDUNKNOWN range checks that would prevent oversize buffers being copied from userspace to kernel space were bypassed.
The kernel would loop on a a value passed by userspace and can copy memory outside of the intended range. This can corrupt memory located after the struct in memory, duplicating the kernel memory or crashing the system
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93a2001bdfd5376c3dc2158653034c20392d15c5
Other sources
Multiple heap-based buffer overflows in the hiddevioctlusage function in drivers/hid/usbhid/hiddev.c in the Linux kernel through 4.6.3 allow local users to cause a denial of service or possibly have unspecified other impact via a crafted (1) HIDIOCGUSAGES or (2) HIDIOCSUSAGES ioctl call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-5829?
CVE-2016-5829 is a vulnerability in the Linux kernel that allows local users to cause a denial of service or possibly have other unspecified impact via a crafted HIDIOCGUSAGES or HIDIOCSUSAGES ioctl call.
How severe is CVE-2016-5829?
CVE-2016-5829 is classified as a medium severity vulnerability.
Which software versions are affected by CVE-2016-5829?
CVE-2016-5829 affects various versions of the Linux kernel: 3.2.0-109.150, 3.13.0-95.142, 4.4.0-36.55, and 4.7~ (upstream).
How can I fix CVE-2016-5829?
To fix CVE-2016-5829, update your Linux kernel to version 3.2.0-109.150, 3.13.0-95.142, 4.4.0-36.55, or a later version.
Where can I find more information about CVE-2016-5829?
You can find more information about CVE-2016-5829 at the following references: [link1](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93a2001bdfd5376c3dc2158653034c20392d15c5), [link2](http://seclists.org/oss-sec/2016/q2/609), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1350513).