CVE-2016-2184

What it actually does

The create_fixed_stream_quirk function in sound/usb/quirks.c performs insufficient validation of the endpoints value from a USB device descriptor, resulting in a NULL pointer dereference or double free that crashes the kernel.

Why it matters to the business

Systems may experience sudden crashes and loss of availability when a malicious USB audio device is physically connected; the requirement for physical access and low EPSS keep overall operational risk low for most environments.

How an attack unfolds

An attacker crafts a USB device descriptor containing an invalid endpoints value, connects the device to a Linux system with the vulnerable snd-usb-audio driver, and triggers create_fixed_stream_quirk during device enumeration, causing a kernel crash.

How to fix it

Update the Linux kernel to a version containing commit 0f886ca12765d20124bd06291c82951fd49a33be or later; rebuild and reboot with the patched kernel. Restrict physical USB access where feasible until the update is applied.

How to confirm the fix worked

Confirm the running kernel contains commit 0f886ca12765d20124bd06291c82951fd49a33be via git log or package version; attempt connection of a test device with crafted endpoints in a lab environment and verify absence of crash.

Typical attack path

1. Craft a USB device with a malicious endpoints value in its descriptor
2. Obtain physical access to the target system
3. Insert the device into a USB port
4. Trigger device enumeration to execute the vulnerable code path
5. Observe NULL dereference or double free leading to system crash

How to detect it

Review kernel logs for oops or panic entries referencing sound/usb/quirks.c or create_fixed_stream_quirk around the time of unexpected USB device connections; correlate with physical access logs or USB device insertion events.

What your security team should do

• Apply the kernel patch containing commit 0f886ca12765d20124bd06291c82951fd49a33be as soon as possible on exposed systems
• Enforce USB device allow-listing or physical port controls to reduce exposure
• Monitor for kernel oops or panic logs related to snd-usb-audio after any USB audio device insertion