What’s Vulnerable › Vulnerabilities
CVE-2016-4578
- Severity: medium (CVSS 5.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2016-05-23 · updated 2026-06-17
- Weakness: CWE-200
Description
sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 15.10, 16.04
- Debian Linux: 8.0
- Linux kernel: through 4.6
- openSUSE Leap: 42.1
- Opensuse: 13.1
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6
- RedHat Enterprise Linux Server Eus: 7.3, 7.4, 7.5, 7.6
- RedHat Enterprise Linux Server Tus: 7.3, 7.6
- RedHat Enterprise Linux Workstation: 7.0
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4ec8cc8039a7063e24204299b462bd1383184a5
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html
- http://rhn.redhat.com/errata/RHSA-2016-2574.html
- http://rhn.redhat.com/errata/RHSA-2016-2584.html
- http://www.debian.org/security/2016/dsa-3607
Get alerted when CVE-2016-4578 or the next vulnerability affects your stack