PT-2016-6375 · Linux+1 · Linux Kernel+1

Published 2015-06-03 · Updated 2020-08-03 · CVE-2016-5340

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x

Description The issue arises from the mishandling of pointer validation within the KGSL Linux Graphics Module by the is ashmem file function in drivers/staging/android/ashmem.c. This allows attackers to bypass intended access restrictions by utilizing the /ashmem string as the dentry name.

Recommendations For Linux kernel version 3.x, consider restricting access to the /ashmem string to minimize the risk of exploitation until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2015-1485

ALT-PU-2015-1849

CVE-2016-5340

Affected Products

Alt Linux

Linux Kernel

References · 10

• https://osv.dev/vulnerability/CVE-2016-5340 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5340 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-5340 · Security Note
• https://ubuntu.com/security/CVE-2016-5340 · Vendor Advisory
• https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=06e51489061e5473b4e2035c79dcf7c27a6f75a6 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5340 · Vendor Advisory
• http://securitytracker.com/id/1036763 · Note
• http://source.android.com/security/bulletin/2016-10-01.html · Note
• http://securityfocus.com/bid/92374 · Note
• https://codeaurora.org/invalid-path-check-ashmem-memory-file-cve-2016-5340 · Note