UBUNTU-CVE-2016-4482

Dashboard / Vulnerabilities / UBUNTU-CVE-2016-4482

UBUNTU-CVE-2016-4482

Summary:

Details: The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.

References: https://ubuntu.com/security/CVE-2016-4482, http://www.spinics.net/lists/linux-usb/msg140243.html, http://www.openwall.com/lists/oss-security/2016/05/04/6, https://git.kernel.org/cgit/linux/kernel/git/gregkh/usb.git/commit/?h=usb-next&id=681fef8380eb818c0b845fca5d2ab1dcbab114ee, https://ubuntu.com/security/notices/USN-3016-1, https://ubuntu.com/security/notices/USN-3016-2, https://ubuntu.com/security/notices/USN-3017-1, https://ubuntu.com/security/notices/USN-3017-3, https://ubuntu.com/security/notices/USN-3016-3, https://ubuntu.com/security/notices/USN-3016-4, https://ubuntu.com/security/notices/USN-3017-2, https://ubuntu.com/security/notices/USN-3020-1, https://ubuntu.com/security/notices/USN-3018-2, https://ubuntu.com/security/notices/USN-3018-1, https://ubuntu.com/security/notices/USN-3019-1, https://ubuntu.com/security/notices/USN-3021-2, https://ubuntu.com/security/notices/USN-3021-1, https://www.cve.org/CVERecord?id=CVE-2016-4482