The sndseqioctlremoveevents function in sound/core/seq/seq_clientmgr.c in the Linux kernel before 4.4.1 does not verify FIFO assignment before proceeding with FIFO clearing, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a crafted ioctl call.
[
{
"deprecated": false,
"id": "CVE-2016-2543-05c3aeba",
"digest": {
"line_hashes": [
"277086651792449177437682075714001816895",
"323813524258653482635497772609977107233",
"136511579845798695139823883916248288948",
"174634633412372389534705932052029347525"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/core/seq/seq_clientmgr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@030e2c78d3a91dd0d27fef37e91950dde333eba1",
"signature_type": "Line"
},
{
"deprecated": false,
"id": "CVE-2016-2543-8289aaa4",
"digest": {
"function_hash": "285217090546264347243639770064422672243",
"length": 374.0
},
"signature_version": "v1",
"target": {
"function": "snd_seq_ioctl_remove_events",
"file": "sound/core/seq/seq_clientmgr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@030e2c78d3a91dd0d27fef37e91950dde333eba1",
"signature_type": "Function"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2543.json"
[
{
"deprecated": false,
"id": "CVE-2016-2543-4a773a4f",
"digest": {
"function_hash": "285217090546264347243639770064422672243",
"length": 374.0
},
"signature_version": "v1",
"target": {
"function": "snd_seq_ioctl_remove_events",
"file": "sound/core/seq/seq_clientmgr.c"
},
"source": "https://github.com/torvalds/linux/commit/030e2c78d3a91dd0d27fef37e91950dde333eba1",
"signature_type": "Function"
},
{
"deprecated": false,
"id": "CVE-2016-2543-ecd672e2",
"digest": {
"line_hashes": [
"277086651792449177437682075714001816895",
"323813524258653482635497772609977107233",
"136511579845798695139823883916248288948",
"174634633412372389534705932052029347525"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/core/seq/seq_clientmgr.c"
},
"source": "https://github.com/torvalds/linux/commit/030e2c78d3a91dd0d27fef37e91950dde333eba1",
"signature_type": "Line"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2543.json"