PT-2016-6018 · Linux+3 · Linux Kernel+3

Jann Horn · Publicado 2016-05-05 · Atualizado 2024-06-15 · CVE-2016-4557

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.5.5

Description The issue arises from the replace map fd with map ptr function in kernel/bpf/verifier.c, which fails to properly maintain an fd data structure. This allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.

Recommendations For Linux kernel versions prior to 4.5.5, update to version 4.5.5 or later to resolve the issue.

Exploit

Correção

Identificadores relacionados

ALT-PU-2016-1534

ALT-PU-2016-1538

CVE-2016-4557

OPENSUSE-SU-2016_1641-1

OPENSUSE-SU-2016_2290-1

OPENSUSE-SU-2024:10128-1

USN-2965-1

USN-2965-2

USN-2965-3

USN-2965-4

Produtos afetados

Alt Linux

Linux Kernel

Suse

Ubuntu

Referências · 127

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/bpf_priv_esc.rb · Exploit
• 🔥 https://exploit-db.com/exploits/39772 · Exploit
• 🔥 https://exploit-db.com/exploits/40759 · Exploit
• https://github.com/torvalds/linux/commit/8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-1583 · Nota
• https://ubuntu.com/security/notices/USN-2965-4 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-6828 · Nota
• https://suse.com/security/cve/CVE-2015-7550 · Nota
• http://openwall.com/lists/oss-security/2016/05/06/4 · Nota
• https://suse.com/security/cve/CVE-2016-4485 · Nota
• https://suse.com/security/cve/CVE-2010-1436 · Nota
• https://suse.com/security/cve/CVE-2010-3310 · Nota
• https://ubuntu.com/security/CVE-2016-2188 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-3156 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-4557 · Nota