CVEvulnerability

CVE-2016-4578

5.5 MEDIUM Published 2016-05-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-05-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.5 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.

Affected configurations

• linux linux kernel (<= 4.6) • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • canonical ubuntu linux 15.10 • canonical ubuntu linux 16.04 • debian debian linux 8.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.3 • redhat enterprise linux server aus 7.4 • redhat enterprise linux server aus 7.6 • redhat enterprise linux server eus 7.3 • redhat enterprise linux server eus 7.4 • redhat enterprise linux server eus 7.5 • redhat enterprise linux server eus 7.6 • redhat enterprise linux server tus 7.3 • redhat enterprise linux server tus 7.6 • redhat enterprise linux workstation 7.0 • opensuse leap 42.1 • opensuse opensuse 13.1

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References