PT-2017-1721 · Openbsd · Openbsd

Jesse Hertz · Published 2017-03-07 · Updated 2017-03-09 · CVE-2016-6247

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenBSD versions 5.8 through 5.9

Description The issue allows certain local users to cause a denial of service, resulting in a kernel panic. This can be achieved by unmounting a filesystem with an open vnode on the mnt vnodelist. The problem exists due to insufficient input validation in the operating system.

Recommendations For OpenBSD versions 5.8 and 5.9, consider restricting the ability to unmount filesystems with open vnodes as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-00874

CVE-2016-6247

Affected Products

Openbsd

References · 8

• 🔥 http://openwall.com/lists/oss-security/2016/07/17/7 · Exploit
• https://bdu.fstec.ru/vul/2017-00874 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-6247 · Security Note
• https://osv.dev/vulnerability/CVE-2016-6247 · Vendor Advisory
• http://openbsd.org/errata58.html · Note
• http://openwall.com/lists/oss-security/2016/07/14/5 · Note
• http://securityfocus.com/bid/91805 · Note
• http://openbsd.org/errata59.html · Note