PT-2016-4662 · Linux+3 · Linux Kernel+3

David Sinquin · Publicado 2016-06-28 · Atualizado 2024-06-15 · CVE-2016-1237

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.6.3

Description The issue allows local users to bypass intended file-permission restrictions. This is related to the handling of POSIX ACLs in the nfsd component of the Linux kernel, specifically in the nfs2acl.c, nfs3acl.c, and nfs4acl.c files.

Recommendations For Linux kernel versions prior to 4.6.3, update to a version that includes the necessary fixes to prevent the bypassing of file-permission restrictions.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2016-1774

ALT-PU-2017-1330

CVE-2016-1237

DSA-3607-1

MGASA-2016-0271

MGASA-2016-0283

MGASA-2016-0284

OPENSUSE-SU-2016_2290-1

OPENSUSE-SU-2016_2625-1

OPENSUSE-SU-2024:10128-1

USN-3053-1

USN-3070-1

USN-3070-2

USN-3070-3

USN-3070-4

Produtos afetados

Alt Linux

Linux Kernel

Suse

Ubuntu

Referências · 134

• https://github.com/torvalds/linux/commit/999653786df6954a31044528ac3f7a5dadca08f4 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-1180 · Nota
• https://suse.com/security/cve/CVE-2010-2954 · Nota
• https://suse.com/security/cve/CVE-2016-1583 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10128-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-1577 · Nota
• https://ubuntu.com/security/notices/USN-3053-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3053-1 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2016-0284.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2010-1436 · Nota
• https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.16 · Nota
• https://suse.com/security/cve/CVE-2016-3135 · Nota
• https://suse.com/security/cve/CVE-2014-8133 · Nota
• https://suse.com/security/cve/CVE-2016-3689 · Nota
• https://suse.com/security/cve/CVE-2011-0711 · Nota