Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).
CVE-2016-2384
Severity
4.6MEDIUM
EPSS
9.0%
top 7.39%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedApr 27
Latest updateMay 14
Description
Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 0.9 | Impact: 3.6
Affected Packages3 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-7h8g-mrh3-v7rc: Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi↗2022-05-14
CVEList▶
CVE-2016-2384: Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi↗2016-04-27
OSV▶
CVE-2016-2384: Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi↗2016-04-27
💥Exploits & PoCs
1Exploit-DB▶
Linux Kernel 3.x (Ubuntu 14.04 / Mint 17.3 / Fedora 22) - Double-free usb-midi SMEP Privilege Escalation↗2016-02-22