PT-2016-7792 · Linux+5 · Linux Kernel+5

Adam Mariš

·

Publicado

2016-12-31

·

Atualizado

2019-10-09

·

CVE-2016-9604

CVSS v3.1

4.4

Média

VetorAV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.11-rc8
Description A security issue allows root to gain direct access to an internal keyring, such as '.dns resolver' or '.builtin trusted keys', by joining it as its session keyring. This enables root to bypass module signature verification by adding a new public key to the keyring.
Recommendations For Linux kernel versions prior to 4.11-rc8, update to a version 4.11-rc8 or later to resolve the issue.

Correção

Incorrect Permission

Improper Verification of Cryptographic Signature

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-732CWE-347

Identificadores relacionados

ALT-PU-2017-1854
ALT-PU-2018-1991
CESA-2017_1842
CVE-2016-9604
DLA-922-1
MGASA-2017-0136
MGASA-2017-0147
MGASA-2017-0148
RHSA-2017:1842
RHSA-2017:2077
RHSA-2017:2669
RHSA-2017_1842
RHSA-2017_2077
SUSE-SU-2017:1360-1
SUSE-SU-2017:2920-1
USN-3312-1
USN-3312-2
USN-3314-1
USN-3361-1
USN-3422-1
USN-3422-2

Produtos afetados

Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu