PT-2016-4662 · Linux+3 · Linux Kernel+3

David Sinquin · Published 2016-06-28 · Updated 2024-06-15 · CVE-2016-1237

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.6.3

Description The issue allows local users to bypass intended file-permission restrictions. This is related to the handling of POSIX ACLs in the nfsd component of the Linux kernel, specifically in the nfs2acl.c, nfs3acl.c, and nfs4acl.c files.

Recommendations For Linux kernel versions prior to 4.6.3, update to a version that includes the necessary fixes to prevent the bypassing of file-permission restrictions.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2016-1774

ALT-PU-2017-1330

CVE-2016-1237

DSA-3607-1

MGASA-2016-0271

MGASA-2016-0283

MGASA-2016-0284

OPENSUSE-SU-2016_2290-1

OPENSUSE-SU-2016_2625-1

OPENSUSE-SU-2024:10128-1

USN-3053-1

USN-3070-1

USN-3070-2

USN-3070-3

USN-3070-4

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 134

• https://github.com/torvalds/linux/commit/999653786df6954a31044528ac3f7a5dadca08f4 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10128-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3053-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3053-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0284.html · Security Note
• http://ubuntu.com/usn/USN-3053-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3070-4 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0271 · Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=999653786df6954a31044528ac3f7a5dadca08f4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1237 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1237 · Security Note
• https://ubuntu.com/security/CVE-2016-5400 · Vendor Advisory
• http://ubuntu.com/usn/USN-3070-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3070-2 · Vendor Advisory