CVE-2016-5344
Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.73%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple integer overflows in the MDSS driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service or possibly have unspecified other impact via a large size value, related to mdss_compat_utils.c, mdss_fb.c, and mdss_rotator.c.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.73% probability · 76th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-190
- Affected
- google/android · linux/linux kernel
- Source
- cve@mitre.org
References
- http://source.android.com/security/bulletin/2016-10-01.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/92695Third Party Advisory, VDB Entry
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7Mailing List, Patch, Third Party Advisory
- https://www.codeaurora.org/integer-overflow-mdss-driver-cve-2016-5344Broken Link
- http://source.android.com/security/bulletin/2016-10-01.htmlPatch, Third Party Advisory
- http://www.securityfocus.com/bid/92695Third Party Advisory, VDB Entry
- https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=1d2297267c24f2c44bd0ecb244ddb8bc880a29b7Mailing List, Patch, Third Party Advisory
- https://www.codeaurora.org/integer-overflow-mdss-driver-cve-2016-5344Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.