PT-2016-6797 · Linux+3 · Linux Kernel+3

Cai Qian + 1 · Published 2016-05-24 · Updated 2019-12-27 · CVE-2016-6198

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.5.5

Description The issue is related to the filesystem layer in the Linux kernel, where it proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink. This allows local users to cause a denial of service, resulting in a system crash, via a rename system call. The issue is related to the fs/namei.c and fs/open.c files.

Recommendations For Linux kernel versions prior to 4.5.5, update to version 4.5.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of OverlayFS to minimize the risk of exploitation. Avoid using the rename system call on OverlayFS files that have been renamed to self-hardlinks until the issue is resolved.

Exploit

Fix

DoS

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2016-1538

ALT-PU-2017-1330

CESA-2016_1847

CESA-2016_2574

CVE-2016-6198

RHSA-2016:1847

RHSA-2016:1875

RHSA-2016:2574

RHSA-2016:2584

RHSA-2016_1847

RHSA-2016_1875

RHSA-2016_2574

RHSA-2016_2584

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

References · 30

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/bpf_priv_esc.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb · Exploit
• 🔥 https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-2384 · Exploit
• 🔥 https://github.com/wpengfei/CVE-2016-6516-exploit · Exploit
• 🔥 http://openwall.com/lists/oss-security/2016/07/11/8 · Exploit
• https://github.com/torvalds/linux/commit/54d5ca871e72f2bb172ec9323497f01cd5091ec7 · Patch
• https://github.com/torvalds/linux/commit/9409e22acdfc9153f88d9b1ed2bd2a5b34d2d3ca · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-6198 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6198 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2016-3587.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6198 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2584.html · Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54d5ca871e72f2bb172ec9323497f01cd5091ec7 · Patch
• https://security-tracker.debian.org/tracker/CVE-2016-6198 · Vendor Advisory