CVE-2016-3951

CWE-416 — Use After Free23 documents9 sources
Severity
4.6MEDIUM
EPSS
0.0%
top 88.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Canonical Ubuntu LinuxLinux Linux KernelNovell Suse Linux Enterprise Desktop+7 more
Timeline
PublishedMay 2
Latest updateMay 17

Description

Double free vulnerability in drivers/net/usb/cdc_ncm.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (system crash) or possibly have unspecified other impact by inserting a USB device with an invalid USB descriptor.

CVSS vector

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 0.9 | Impact: 3.6

Affected Packages10 packages

▶Debianlinux< 4.5.1-1+3

Also affects: Ubuntu Linux 12.04, 14.04, 15.10

🔴Vulnerability Details

3
GHSA
GHSA-p55p-5prc-ppxq: Double free vulnerability in drivers/net/usb/cdc_ncm↗2022-05-17
▶
CVEList
CVE-2016-3951: Double free vulnerability in drivers/net/usb/cdc_ncm↗2016-05-02
▶
OSV
CVE-2016-3951: Double free vulnerability in drivers/net/usb/cdc_ncm↗2016-05-02
▶

📋Vendor Advisories

16
Android
CVE-2016-3951: Android Security Bulletin 2016-09-01 CVE: CVE-2016-3951 Severity: CRITICAL References: A-28744625 Upstream kernel [2]↗2016-09-01
▶
Ubuntu
Linux kernel vulnerabilities↗2016-06-27
▶
Ubuntu
Linux kernel (OMAP4) vulnerabilities↗2016-06-27
▶
Ubuntu
Linux kernel (Vivid HWE) vulnerabilities↗2016-06-10
▶
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities↗2016-06-10
▶

💬Community

3
Bugzilla
CVE-2015-8945 openshift-origin: Logging of private RSA keys into systemd journal↗2016-07-12
▶
Bugzilla
CVE-2016-3951 kernel: crash on invalid USB device descriptors (usbnet driver) [fedora-all]↗2016-04-07
▶
Bugzilla
CVE-2016-3951 kernel: crash on invalid USB device descriptors (usbnet driver)↗2016-04-07
▶