PT-2017-9931 · Joyent · Smartos

Published 2017-01-31 · Updated 2022-04-19 · CVE-2016-9039

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Joyent SmartOS version 20161110T013148Z

Description A denial of service issue exists due to a memory exhaustion vulnerability in the Hyprlofs file system. The issue is present in the Ioctl system call with the command HYPRLOFS ADD ENTRIES, allowing an attacker to cause a buffer to be allocated and never freed. Repeated exploitation can lead to full system denial of service.

Recommendations For Joyent SmartOS version 20161110T013148Z, as a temporary workaround, consider restricting the use of the HYPRLOFS ADD ENTRIES command in the Ioctl system call to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2016-9039

Affected Products

Smartos

References · 4

• 🔥 http://talosintelligence.com/reports/TALOS-2016-0257 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-9039 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9039 · Vendor Advisory
• http://securityfocus.com/bid/95916 · Note