PT-2016-5648 · Linux+5 · Linux Kernel+5

Hector Marco + 1 · Published 2016-04-27 · Updated 2023-09-12 · CVE-2016-3672

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.5.2

Description The issue concerns the arch pick mmap layout function in the Linux kernel, which fails to properly randomize the legacy base address. This makes it easier for local users to bypass the ASLR protection mechanism for a setuid or setgid program by disabling stack-consumption resource limits, thus defeating the intended restrictions on the ADDR NO RANDOMIZE flag.

Recommendations For Linux kernel versions through 4.5.2, update to a version that includes a fix for this issue to ensure proper randomization of the legacy base address and maintain the effectiveness of the ASLR protection mechanism.

Exploit

Fix

Weakness Enumeration

CWE-254

Related Identifiers

ALT-PU-2016-1470

ALT-PU-2017-1330

CESA-2018_1062

CVE-2016-3672

DLA-516-1

DSA-3607-1

MGASA-2016-0225

MGASA-2016-0233

OPENSUSE-SU-2016_1641-1

OPENSUSE-SU-2016_2144-1

OPENSUSE-SU-2016_2184-1

RHSA-2018:0676

RHSA-2018:1062

RHSA-2018_0676

RHSA-2018_1062

SUSE-SU-2016:1690-1

SUSE-SU-2016:1937-1

SUSE-SU-2016:2105-1

USN-2965-1

USN-2965-2

USN-2965-3

USN-2965-4

USN-2989-1

USN-2996-1

USN-2997-1

USN-2998-1

USN-3000-1

USN-3001-1

USN-3002-1

USN-3003-1

USN-3004-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 338

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/bpf_priv_esc.rb · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-5754.md · Exploit
• 🔥 https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-5715.md · Exploit
• 🔥 https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-2384 · Exploit
• 🔥 https://github.com/opsxcq/exploit-cve-2017-5715 · Exploit
• 🔥 https://github.com/wpengfei/CVE-2016-6516-exploit · Exploit
• 🔥 https://exploit-db.com/exploits/39669 · Exploit
• https://github.com/torvalds/linux/commit/8b8addf891de8a00e4d39fc32f93f7c5eb8feceb · Vendor Advisory
• http://ubuntu.com/usn/USN-2997-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-2989-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3000-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3156 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0233 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0676 · Vendor Advisory