sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) sndtimeruserccallback and (2) sndtimerusertinterrupt functions.
[
{
"id": "CVE-2016-4578-1ec88262",
"signature_version": "v1",
"digest": {
"function_hash": "113150281094612787868519838968728969674",
"length": 595.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6",
"signature_type": "Function",
"target": {
"file": "sound/core/timer.c",
"function": "snd_timer_user_ccallback"
}
},
{
"id": "CVE-2016-4578-28db86ba",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"237728596960966787494281885851578390183",
"170282089142449455472638488529086954740",
"65277166332191802250940453400015479582",
"213728492013998888654898297662839376079"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6",
"signature_type": "Line",
"target": {
"file": "sound/core/timer.c"
}
},
{
"id": "CVE-2016-4578-4c6923e7",
"signature_version": "v1",
"digest": {
"function_hash": "309088919678454112341308611677096866973",
"length": 1411.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@e4ec8cc8039a7063e24204299b462bd1383184a5",
"signature_type": "Function",
"target": {
"file": "sound/core/timer.c",
"function": "snd_timer_user_tinterrupt"
}
},
{
"id": "CVE-2016-4578-b61ecb75",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"54508324069846810709173359752826422836",
"247314540258600462105688246448318251757",
"287241809543069006028107820929944163907",
"170786399250284934662100300055896841538"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@e4ec8cc8039a7063e24204299b462bd1383184a5",
"signature_type": "Line",
"target": {
"file": "sound/core/timer.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4578.json"
[
{
"id": "CVE-2016-4578-6fd48a9a",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"237728596960966787494281885851578390183",
"170282089142449455472638488529086954740",
"65277166332191802250940453400015479582",
"213728492013998888654898297662839376079"
]
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6",
"signature_type": "Line",
"target": {
"file": "sound/core/timer.c"
}
},
{
"id": "CVE-2016-4578-b345f887",
"signature_version": "v1",
"digest": {
"function_hash": "113150281094612787868519838968728969674",
"length": 595.0
},
"deprecated": false,
"source": "https://github.com/torvalds/linux/commit/9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6",
"signature_type": "Function",
"target": {
"file": "sound/core/timer.c",
"function": "snd_timer_user_ccallback"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4578.json"