CVE-2016-4482

The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted USBDEVFS_CONNECTINFO ioctl call.

Published: May 23, 2016
Updated: Nov 9, 2025
CVE: CVE-2016-4482
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 2.1
AV:L/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-200

Affected Software
References

Software	From	Fixed in
canonical / ubuntu_linux	12.04	12.04.x
canonical / ubuntu_linux	16.04	16.04.x
canonical / ubuntu_linux	15.10	15.10.x
canonical / ubuntu_linux	14.04	14.04.x
linux / linux_kernel	-	4.6.x
novell / suse_linux_enterprise_module_for_public_cloud	12.0	12.0.x
novell / suse_linux_enterprise_server	11.0-sp4	11.0-sp4.x
novell / suse_linux_enterprise_server	12.0	12.0.x
novell / suse_linux_enterprise_server	11.0-extra	11.0-extra.x
novell / suse_linux_enterprise_live_patching	12.0	12.0.x
novell / suse_linux_enterprise_server	12.0-sp1	12.0-sp1.x
novell / suse_linux_enterprise_desktop	12.0-sp1	12.0-sp1.x
novell / suse_linux_enterprise_real_time_extension	12.0-sp1	12.0-sp1.x
novell / suse_linux_enterprise_desktop	12.0	12.0.x
novell / suse_linux_enterprise_software_development_kit	12.0-sp1	12.0-sp1.x
novell / suse_linux_enterprise_workstation_extension	12.0	12.0.x
novell / suse_linux_enterprise_software_development_kit	12.0	12.0.x
novell / suse_linux_enterprise_workstation_extension	12.0-sp1	12.0-sp1.x
novell / suse_linux_enterprise_debuginfo	11.0-sp4	11.0-sp4.x
novell / suse_linux_enterprise_software_development_kit	11.0-sp4	11.0-sp4.x
fedoraproject / fedora	24	24.x

Vulnerability Database

309,961

CVE-2016-4482

Deep Security Visibility Without the Complexity