PT-2017-9931 · Joyent · Smartos

Publicado 2017-01-31 · Atualizado 2022-04-19 · CVE-2016-9039

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Joyent SmartOS version 20161110T013148Z

Description A denial of service issue exists due to a memory exhaustion vulnerability in the Hyprlofs file system. The issue is present in the Ioctl system call with the command HYPRLOFS ADD ENTRIES, allowing an attacker to cause a buffer to be allocated and never freed. Repeated exploitation can lead to full system denial of service.

Recommendations For Joyent SmartOS version 20161110T013148Z, as a temporary workaround, consider restricting the use of the HYPRLOFS ADD ENTRIES command in the Ioctl system call to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2016-9039

Produtos afetados

Smartos

Referências · 4

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0257 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-9039 · Nota de Segurança
• http://securityfocus.com/bid/95916 · Nota
• https://osv.dev/vulnerability/CVE-2016-9039 · Aviso do Fabricante