CVE-2016-0728 The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or....
HighCVSS 7.8
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.3.3-6 | 4.3.3-6 |
| debian/linux(Debian:13) | < 4.3.3-6 | 4.3.3-6 |
| debian/linux(Debian:14) | < 4.3.3-6 | 4.3.3-6 |
| Google Android | = 4.0 | No fix listed |
| Google Android | = 4.0.1 | No fix listed |
| Google Android | = 4.0.2 | No fix listed |
| Google Android | = 4.0.3 | No fix listed |
| Google Android | = 4.0.4 | No fix listed |
| Google Android | = 4.1 | No fix listed |
| Google Android | = 4.1.2 | No fix listed |
| Google Android | = 4.2 | No fix listed |
| Google Android | = 4.2.1 | No fix listed |
| Google Android | = 4.2.2 | No fix listed |
| Google Android | = 4.3 | No fix listed |
| Google Android | = 4.3.1 | No fix listed |
| Google Android | = 4.4 | No fix listed |
| Google Android | = 4.4.1 | No fix listed |
| Google Android | = 4.4.2 | No fix listed |
| Google Android | = 4.4.3 | No fix listed |
| Google Android | = 5.0 | No fix listed |
| Google Android | = 5.0.1 | No fix listed |
| Google Android | = 5.0.2 | No fix listed |
| Google Android | = 5.1 | No fix listed |
| Google Android | = 5.1.0 | No fix listed |
| Google Android | = 5.1.1 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Android | = 6.0 | No fix listed |
| Google Android | = 6.0.1 | No fix listed |
| HP Inc server migration pack | <= 7.5 | No fix listed |
| Linux kernel | >= 3.8, < 3.10.95 | 3.10.95 |
| Linux kernel | >= 3.11, < 3.12.53 | 3.12.53 |
| Linux kernel | >= 3.13, < 3.14.59 | 3.14.59 |
| Linux kernel | >= 3.15, < 3.16.35 | 3.16.35 |
| Linux kernel | >= 3.17, < 3.18.26 | 3.18.26 |
| Linux kernel | >= 3.19, < 4.1.16 | 4.1.16 |
| Linux kernel | >= 4.2, < 4.3.4 | 4.3.4 |
| Linux kernel | >= 4.4, < 4.4.1 | 4.4.1 |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
References
- Debian Security Tracker CVE-2016-0728 vendor-advisory
- git.kernel.org vendor-advisory
- FEDORA-2016-5d43766e33 mailing-list third-party-advisory vendor-advisory
- FEDORA-2016-b59fd603be mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0205 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0341 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0745 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0746 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0747 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0750 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0751 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0752 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0753 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0755 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0756 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0757 mailing-list third-party-advisory vendor-advisory
- perception-point.io third-party-advisory
- RHSA-2016:0064 third-party-advisory vendor-advisory
- RHSA-2016:0065 third-party-advisory vendor-advisory
- RHSA-2016:0068 third-party-advisory vendor-advisory
- source.android.com vendor-advisory
- DSA-3448 third-party-advisory vendor-advisory
- www.kernel.org vendor-advisory
- [oss-security] 20160119 Linux kernel: use after free in keyring facility. mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- 81054 third-party-advisory vdb-entry
- 1034701 third-party-advisory vdb-entry
- USN-2870-1 third-party-advisory vendor-advisory
- USN-2870-2 third-party-advisory vendor-advisory
- USN-2871-1 third-party-advisory vendor-advisory
- USN-2871-2 third-party-advisory vendor-advisory
- USN-2872-1 third-party-advisory vendor-advisory
- USN-2872-2 third-party-advisory vendor-advisory
- USN-2872-3 third-party-advisory vendor-advisory
- USN-2873-1 third-party-advisory vendor-advisory
- bto.bluecoat.com third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com third-party-advisory
- HPSBHF03436 third-party-advisory vendor-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- security.netapp.com third-party-advisory
- 39277 exploit third-party-advisory vdb-entry