PT-2016-6322 · Linux+3 · Linux Kernel+3

Kangjie Lu · Published 2016-06-27 · Updated 2017-09-19 · CVE-2016-5243

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.6.4

Description The issue is related to the tipc nl compat link dump function in net/tipc/netlink compat.c, which does not properly copy a certain string. This allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.

Recommendations For Linux kernel versions prior to 4.6.4, update to version 4.6.4 or later to resolve the issue. As a temporary workaround, consider restricting access to Netlink messages to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2016-1774

ALT-PU-2017-1330

CVE-2016-5243

DLA-516-1

DSA-3607-1

MGASA-2016-0345

MGASA-2016-0364

SUSE-SU-2017:1247-1

SUSE-SU-2017:1301-1

SUSE-SU-2017:1360-1

SUSE-SU-2017:2342-1

SUSE-SU-2017:2525-1

USN-3049-1

USN-3050-1

USN-3051-1

USN-3052-1

USN-3053-1

USN-3054-1

USN-3055-1

USN-3056-1

USN-3057-1

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 405

• https://github.com/torvalds/linux/commit/5d2be1422e02ccd697ccfcd45c85b4a26e6178e2 · Vendor Advisory
• http://ubuntu.com/usn/USN-3055-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-3057-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3055-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3057-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5243 · Vendor Advisory
• http://ubuntu.com/usn/USN-3051-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0364 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5243 · Security Note
• http://ubuntu.com/usn/USN-3050-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5243 · Security Note
• https://advisories.mageia.org/MGASA-2016-0345.html · Security Note
• https://advisories.mageia.org/MGASA-2016-0364.html · Security Note
• https://ubuntu.com/security/notices/USN-3051-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-3056-1 · Vendor Advisory