PT-2016-6797 · Linux+3 · Linux Kernel+3

Cai Qian + 1 · Publicado 2016-05-24 · Atualizado 2019-12-27 · CVE-2016-6198

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.5.5

Description The issue is related to the filesystem layer in the Linux kernel, where it proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink. This allows local users to cause a denial of service, resulting in a system crash, via a rename system call. The issue is related to the fs/namei.c and fs/open.c files.

Recommendations For Linux kernel versions prior to 4.5.5, update to version 4.5.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of OverlayFS to minimize the risk of exploitation. Avoid using the rename system call on OverlayFS files that have been renamed to self-hardlinks until the issue is resolved.

Exploit

Correção

DoS

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

ALT-PU-2016-1538

ALT-PU-2017-1330

CESA-2016_1847

CESA-2016_2574

CVE-2016-6198

RHSA-2016:1847

RHSA-2016:1875

RHSA-2016:2574

RHSA-2016:2584

RHSA-2016_1847

RHSA-2016_1875

RHSA-2016_2574

RHSA-2016_2584

Produtos afetados

Alt Linux

Centos

Linux Kernel

Red Hat

Referências · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/bpf_priv_esc.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb · Exploit
• 🔥 https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-2384 · Exploit
• 🔥 https://github.com/wpengfei/CVE-2016-6516-exploit · Exploit
• 🔥 http://openwall.com/lists/oss-security/2016/07/11/8 · Exploit
• https://github.com/torvalds/linux/commit/54d5ca871e72f2bb172ec9323497f01cd5091ec7 · Correção
• https://github.com/torvalds/linux/commit/9409e22acdfc9153f88d9b1ed2bd2a5b34d2d3ca · Correção
• https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/rename/rename13.c · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1355654 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6198 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6198 · Aviso do Fabricante
• http://securityfocus.com/bid/91709 · Nota
• https://linux.oracle.com/errata/ELSA-2016-3587.html · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6198 · Aviso do Fabricante
• http://oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html · Aviso do Fabricante