PT-2016-6183 · Linux+5 · Linux Kernel+5

Andrej Nemec

·

Publicado

2016-05-23

·

Atualizado

2023-09-12

·

CVE-2016-4913

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.5.5
Description The issue is related to the get rock ridge filename function in the Linux kernel, which mishandles NM entries containing 0 characters. This allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.
Recommendations For versions prior to 4.5.5, update to version 4.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted isofs filesystems to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2016-1534
ALT-PU-2016-1538
CESA-2018_3083
CVE-2016-4913
DLA-516-1
DSA-3607-1
OPENSUSE-SU-2016_2144-1
RHSA-2018:3083
RHSA-2018:3096
RHSA-2018_3083
RHSA-2018_3096
SUSE-SU-2016:1672-1
SUSE-SU-2016:1985-1
SUSE-SU-2016:2245-1
SUSE-SU-2017:0333-1
USN-3016-1
USN-3016-2
USN-3016-3
USN-3016-4
USN-3017-1
USN-3017-2
USN-3017-3
USN-3018-1
USN-3018-2
USN-3019-1
USN-3020-1
USN-3021-1
USN-3021-2

Produtos afetados

Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu