PT-2016-7625 · Joyent · Smartos

Published 2016-12-14 · Updated 2022-12-13 · CVE-2016-9032

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Joyent SmartOS version 20161110T013148Z

Description A buffer overflow issue exists in the Hyprlofs file system, specifically in the Ioctl system call with the HYPRLOFS ADD ENTRIES command when handling native file systems. An attacker can craft input to cause a buffer overflow in the nm variable, leading to out-of-bounds memory access, which could result in potential privilege escalation.

Recommendations For Joyent SmartOS version 20161110T013148Z, as a temporary workaround, consider restricting the use of the Ioctl system call with the HYPRLOFS ADD ENTRIES command until a patch is available. Avoid using the nm variable in the affected system call to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2016-9032

Affected Products

Smartos

References · 4

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0250 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-9032 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9032 · Vendor Advisory
• http://securityfocus.com/bid/94923 · Note