CVE-2016-4578: canonical ubuntu_linux
Vulnerability summary
CVE-2016-4578 is a medium (CVSS 5.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 1.20% chance of exploitation in the next 30 days, higher than 68.2% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 22 · Related 16Timeline
- 23-05-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack memory via crafted use of the ALSA timer interface, related to the (1) snd_timer_user_ccallback and (2) snd_timer_user_tinterrupt functions.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.5MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.20%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.20% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundLinux Kernel 4.4 (Ubuntu 16.04) - 'snd_timer_user_ccallback()' Kernel Pointer Leak
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu23 products
- linux< 3.13.0-91.138 | < 4.4.0-28.47
- linux-azureAll versions (No fix recorded)
- linux-azure-6.11All versions (No fix recorded)
- linux-azure-fdeAll versions (No fix recorded)
- linux-azure-fde-5.15All versions (No fix recorded)
Redhat6 products
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.3 | 7.4 | 7.6
- enterprise_linux_server_eus7.3 | 7.4 | 7.5 | 7.6
- enterprise_linux_server_tus7.3 | 7.6
Debian2 products
- linux< 4.5.5-1
- debian_linuxEOL8.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.10 | 16.04
Linux1 product
- linux_kernel≤ 4.6
6 vendors · 35 products
References
49 links- lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- github.com/torvalds/linux/commit/e4ec8cc8039a7063e24204299b462bd1383184a5X Refsource CONFIRMVendor Advisory
Show all 49 references
- bugzilla.redhat.com/show_bug.cgi?id=1335215X Refsource CONFIRMIssue TrackingThird Party AdvisoryVDB Entry
- lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- github.com/torvalds/linux/commit/9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6X Refsource CONFIRMVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- git.kernel.org/cgit/…REPORT
- git.kernel.org/cgit/…REPORT