CVE-2016-2066
HighSummary
An integer signedness error in the MSM QDSP6 audio driver for Linux kernel 3.x allows attackers to gain privileges or cause a denial of service via a crafted application making an ioctl call.
Risk Assessment
Organizations may be exposed to privilege escalation by attackers or memory corruption leading to denial of service.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability and to monitor applications using this driver.
Other vulnerabilities in MSM QDSP6 audio driver for Linux kernel 3.x
See all- CVE-2016-2065High
The MSM QDSP6 audio driver for Linux kernel 3.x has a vulnerability that allows attackers to cause a denial of service through out-of-bounds writes. This can lead to memory corruption or other unspecified impacts.
- CVE-2016-2064High
The MSM QDSP6 audio driver for Linux kernel 3.x has a vulnerability that allows attackers to cause a denial of service (buffer over-read) or potentially unspecified other impact via a crafted application making an ioctl call specifying many commands.
- CVE-2016-2068High
The MSM QDSP6 audio driver for Linux kernel 3.x allows attackers to gain privileges or cause a denial of service via a crafted application performing AUDIO_EFFECTS_WRITE or AUDIO_EFFECTS_READ operations.
Original NVD description (English source)
Integer signedness error in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application that makes an ioctl call.