PT-2016-3356 · None · Util-Linux

Federico Bento · Published 2016-02-25 · Updated 2024-06-15 · CVE-2016-2779

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions util-linux (affected versions not specified)

Description The issue is related to a lack of access control during user authentication in the util-linux package, which can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. Specifically, a local user can escape to the parent session via a crafted TIOCSTI ioctl call, pushing characters to the terminal's input buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2021-05297

CVE-2016-2779

OPENSUSE-SU-2024:10279-1

Affected Products

Util-Linux

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2016-2779 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10279-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05297 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2779 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2779 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-2779 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2779 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-2779 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-2779 · Security Note
• https://github.com/util-linux/util-linux/commit/23f75093264aae5d58d61016cb1a29d8ebdfa157 · Note
• https://github.com/util-linux/util-linux/commit/a0a8e9884443601abf9f06b715f2f6bb0820cbad · Note
• https://suse.com/security/cve/CVE-2013-0157 · Note
• http://openwall.com/lists/oss-security/2016/02/27/1 · Note
• http://marc.info/?l=util-linux-ng&m=145694736107128&w=2 · Note