vulnwire
5.5med

CVE-2016-45781 exploit

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensi…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
1
Exploit-DB

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.

Exploit prediction (EPSS)

1.20% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.

Exploits and detections

  • EDB-46529 Linux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak · dos · 2019-03-11

CVSS scores

Assigned byVersionScoreVector
NVD3.05.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Technology feeds
Linux kernel (RSS, critical only)

References

  • lists.opensuse.org /opensuse-security-announce/2016-06/msg00054.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4ec8cc8039a7063e24204299b462bd138318 · x_refsource_CONFIRM, x_transferred
  • ubuntu.com /usn/USN-3017-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • exploit-db.com /exploits/46529/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-08/msg00007.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • ubuntu.com /usn/USN-3017-3 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-08/msg00055.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • ubuntu.com /usn/USN-3018-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • github.com /torvalds/linux/commit/e4ec8cc8039a7063e24204299b462bd1383184a5 · x_refsource_CONFIRM, x_transferred
  • ubuntu.com /usn/USN-3021-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • ubuntu.com /usn/USN-3017-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=1335215 · x_refsource_CONFIRM, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2584.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2574.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • ubuntu.com /usn/USN-3019-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-06/msg00044.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • debian.org /security/2016/dsa-3607 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/90535 · vdb-entry, x_refsource_BID, x_transferred
  • ubuntu.com /usn/USN-3016-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • ubuntu.com /usn/USN-3016-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-06/msg00052.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • ubuntu.com /usn/USN-3021-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • ubuntu.com /usn/USN-3018-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a47e9cff994f37f7f0dbd9ae23740d0f64f9 · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2016/05/11/5 · mailing-list, x_refsource_MLIST, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-08/msg00044.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • ubuntu.com /usn/USN-3016-3 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • github.com /torvalds/linux/commit/9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6 · x_refsource_CONFIRM, x_transferred
  • ubuntu.com /usn/USN-3016-4 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • ubuntu.com /usn/USN-3020-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-08/msg00000.html · vendor-advisory, x_refsource_SUSE, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.