PT-2016-4575 · Linux+5 · Linux Kernel+5
Publicado
2016-12-30
·
Atualizado
2023-06-07
·
CVE-2016-10088
CVSS v3.1
7.0
Alta
| Vetor | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 4.9
Description
The sg implementation in the Linux kernel does not properly restrict write operations in situations where the KERNEL DS option is set, allowing local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c.
Recommendations
For Linux kernel versions through 4.9, update to a version later than 4.9 to resolve the issue. As a temporary workaround, consider restricting access to the /dev/sg device to minimize the risk of exploitation.
Correção
DoS
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu