Race condition in the ecdeviceioctlxcmd function in drivers/platform/chrome/crosec_dev.c in the Linux kernel before 4.7 allows local users to cause a denial of service (out-of-bounds array access) by changing a certain size value, aka a "double fetch" vulnerability.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-6156.json"
[
{
"target": {
"file": "drivers/platform/chrome/cros_ec_dev.c",
"function": "ec_device_ioctl_xcmd"
},
"digest": {
"length": 725.0,
"function_hash": "297423109152019687080449068282521422368"
},
"signature_type": "Function",
"id": "CVE-2016-6156-2d47929b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@096cdc6f52225835ff503f987a0d68ef770bb78e",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/platform/chrome/cros_ec_dev.c"
},
"digest": {
"line_hashes": [
"138838040213094575896123217995654216551",
"81172954855933602856042423567255196813",
"247130526094963146455674639349053988601",
"279179705395734783266809472725159836269",
"283550498504444744688084178054953873473",
"66880490828355141252805187246609643683",
"244507070673975867094119102219938590227",
"253850539241449995728283314663706565887"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2016-6156-991935d7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@096cdc6f52225835ff503f987a0d68ef770bb78e",
"deprecated": false,
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-6156.json"
[
{
"target": {
"file": "drivers/platform/chrome/cros_ec_dev.c",
"function": "ec_device_ioctl_xcmd"
},
"digest": {
"length": 725.0,
"function_hash": "297423109152019687080449068282521422368"
},
"signature_type": "Function",
"id": "CVE-2016-6156-0a1ba014",
"source": "https://github.com/torvalds/linux/commit/096cdc6f52225835ff503f987a0d68ef770bb78e",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "drivers/platform/chrome/cros_ec_dev.c"
},
"digest": {
"line_hashes": [
"138838040213094575896123217995654216551",
"81172954855933602856042423567255196813",
"247130526094963146455674639349053988601",
"279179705395734783266809472725159836269",
"283550498504444744688084178054953873473",
"66880490828355141252805187246609643683",
"244507070673975867094119102219938590227",
"253850539241449995728283314663706565887"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2016-6156-6627a3cd",
"source": "https://github.com/torvalds/linux/commit/096cdc6f52225835ff503f987a0d68ef770bb78e",
"deprecated": false,
"signature_version": "v1"
}
]