CVE-2016-2384

moderate-risk

Published 2016-04-27

Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.

Do I need to act?

~

9.0% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

!

1 public exploit available

41999

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

4

CVSS 4.6/10 Medium

PHYSICAL / LOW complexity

Affected Products (2)

Linux Kernel

Suse Linux Enterprise Real Time Extension

Affected Vendors

Novell Linux

References (76)

Patch http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07d86c...

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00025.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00026.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00027.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00028.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00030.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00032.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00033.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00034.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00036.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00037.html

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html

Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html

http://rhn.redhat.com/errata/RHSA-2016-2574.html

and 56 more references

33

/ 100

moderate-risk

Severity 16/34 · Moderate

Exploitability 10/34 · Low

Exposure 7/34 · Low