CVE-2016-3951 Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified oth...
MediumCVSS 4.6
EPSS 0.59%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.5.1-1 | 4.5.1-1 |
| debian/linux(Debian:13) | < 4.5.1-1 | 4.5.1-1 |
| debian/linux(Debian:14) | < 4.5.1-1 | 4.5.1-1 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| novell suse linux enterprise software development kit | = 12.0-sp1 | No fix listed |
| suse linux enterprise software development kit | = 12.0 | No fix listed |
| novell suse linux enterprise desktop | = 12 | No fix listed |
| novell suse linux enterprise desktop | = 12-sp1 | No fix listed |
| novell suse linux enterprise live patching | = 12.0 | No fix listed |
| novell suse linux enterprise module for public cloud | = 12 | No fix listed |
| novell suse linux enterprise real time extension | = 12-sp1 | No fix listed |
| novell suse linux enterprise server | = 12.0 | No fix listed |
| novell suse linux enterprise server | = 12.0-sp1 | No fix listed |
| novell suse linux enterprise workstation extension | = 12.0 | No fix listed |
| novell suse linux enterprise workstation extension | = 12.0-sp1 | No fix listed |
| Linux kernel | = 4.5.0-rc7 | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-2965-1 vendor-advisory
- USN-2965-4 vendor-advisory
- USN-2965-3 vendor-advisory
- USN-2965-2 vendor-advisory
- USN-2989-1 vendor-advisory
- USN-2998-1 vendor-advisory
- USN-3000-1 vendor-advisory
- USN-3001-1 vendor-advisory
- USN-3002-1 vendor-advisory
- USN-3003-1 vendor-advisory
- USN-3004-1 vendor-advisory
- USN-3021-2 vendor-advisory
- USN-3021-1 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2016-3951 vendor-advisory
- git.kernel.org vendor-advisory
- git.kernel.org vendor-advisory
- openSUSE-SU-2016:1382 vendor-advisory
- SUSE-SU-2016:1690 third-party-advisory vendor-advisory
- SUSE-SU-2016:1696 third-party-advisory vendor-advisory
- SUSE-SU-2016:1764 third-party-advisory vendor-advisory
- DSA-3607 vendor-advisory
- [oss-security] 20160406 Fwd: CVE Request: Linux: usbnet: memory corruption triggered by invalid USB descriptor mailing-list
- 91028 vdb-entry
- 1036763 vdb-entry
- USN-2989-1 third-party-advisory vendor-advisory
- USN-2998-1 third-party-advisory vendor-advisory
- USN-3000-1 third-party-advisory vendor-advisory
- USN-3001-1 third-party-advisory vendor-advisory
- USN-3002-1 third-party-advisory vendor-advisory
- USN-3003-1 third-party-advisory vendor-advisory
- USN-3004-1 third-party-advisory vendor-advisory
- USN-3021-1 third-party-advisory vendor-advisory
- USN-3021-2 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking
- github.com vendor-advisory
- github.com vendor-advisory
- [netdev] 20160304 Re: Possible double-free in the usbnet driver mailing-list