CVE-2016-4578 : sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.

Published 2016-05-23 10:59:09

Updated 2019-03-25 18:58:20

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2016-4578

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Desktop » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 7.3
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 7.4
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Eus » Version: 7.3
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Eus » Version: 7.4
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Eus » Version: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Eus » Version: 7.5
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Tus » Version: 7.3
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Tus » Version: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions up to, including, (<=) 4.6
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.10
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions
Opensuse » Opensuse » Version: 13.1
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 42.1
cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-4578

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 46 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-4578

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2016-4578

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-4578

http://www.securityfocus.com/bid/90535

Linux Kernel CVE-2016-4578 Multiple Local Information Disclosure Vulnerabilities
Third Party Advisory;VDB Entry
http://www.ubuntu.com/usn/USN-3019-1

USN-3019-1: Linux kernel (Utopic HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6

kernel/git/torvalds/linux.git - Linux kernel source tree
Vendor Advisory
http://www.ubuntu.com/usn/USN-3016-4

USN-3016-4: Linux kernel (Xenial HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3020-1

USN-3020-1: Linux kernel (Vivid HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3017-2

USN-3017-2: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2574.html

RHSA-2016:2574 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html

[security-announce] SUSE-SU-2016:1672-1: important: Security update for
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3016-1

USN-3016-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html

[security-announce] SUSE-SU-2016:1690-1: important: Security update for
Third Party Advisory

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=1335215

1335215 – (CVE-2016-4578) CVE-2016-4578 kernel: Information leak in events in timer.c
Issue Tracking;Third Party Advisory;VDB Entry
https://github.com/torvalds/linux/commit/e4ec8cc8039a7063e24204299b462bd1383184a5

ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt · torvalds/linux@e4ec8cc · GitHub
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html

[security-announce] SUSE-SU-2016:1937-1: important: Security update for
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html

[security-announce] openSUSE-SU-2016:1641-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3016-3

USN-3016-3: Linux kernel (Qualcomm Snapdragon) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3021-1

USN-3021-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3021-2

USN-3021-2: Linux kernel (OMAP4) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3017-3

USN-3017-3: Linux kernel (Wily HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://github.com/torvalds/linux/commit/9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6

ALSA: timer: Fix leak in events via snd_timer_user_ccallback · torvalds/linux@9a47e9c · GitHub
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html

[security-announce] SUSE-SU-2016:2105-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/46529/

Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak
Exploit;VDB Entry;Third Party Advisory
http://www.ubuntu.com/usn/USN-3018-1

USN-3018-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html

[security-announce] SUSE-SU-2016:1985-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4ec8cc8039a7063e24204299b462bd1383184a5

kernel/git/torvalds/linux.git - Linux kernel source tree
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html

[security-announce] openSUSE-SU-2016:2184-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2584.html

RHSA-2016:2584 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://www.debian.org/security/2016/dsa-3607

Debian -- Security Information -- DSA-3607-1 linux
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/05/11/5

oss-security - Re: CVE Request: alsa: kernel information leak vulnerability in Linux sound/core/timer
Mailing List
http://www.ubuntu.com/usn/USN-3017-1

USN-3017-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3018-2

USN-3018-2: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3016-2

USN-3016-2: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2016-4578

Products affected by CVE-2016-4578

Exploit prediction scoring system (EPSS) score for CVE-2016-4578

CVSS scores for CVE-2016-4578

CWE ids for CVE-2016-4578

References for CVE-2016-4578