CVE-2016-4470 The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of se...
MediumCVSS 5.5
EPSS 0.58%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.6.2-2 | 4.6.2-2 |
| debian/linux(Debian:13) | < 4.6.2-2 | 4.6.2-2 |
| debian/linux(Debian:14) | < 4.6.2-2 | 4.6.2-2 |
| oracle vm server | = 3.3 | No fix listed |
| oracle vm server | = 3.4 | No fix listed |
| oracle linux | = 5.0 | No fix listed |
| oracle linux | = 6 | No fix listed |
| oracle linux | = 7 | No fix listed |
| Linux kernel | <= 4.6.3 | No fix listed |
| novell suse linux enterprise real time extension | = 12.0-sp1 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux for real time | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux hpc node eus | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| redhat enterprise mrg | = 2.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-4470 vendor-advisory
- git.kernel.org vendor-advisory
- SUSE-SU-2016:1937 third-party-advisory vendor-advisory
- SUSE-SU-2016:1961 vendor-advisory
- SUSE-SU-2016:1985 vendor-advisory
- SUSE-SU-2016:1994 vendor-advisory
- SUSE-SU-2016:1995 vendor-advisory
- SUSE-SU-2016:1998 vendor-advisory
- SUSE-SU-2016:1999 vendor-advisory
- SUSE-SU-2016:2000 vendor-advisory
- SUSE-SU-2016:2001 vendor-advisory
- SUSE-SU-2016:2002 vendor-advisory
- SUSE-SU-2016:2003 vendor-advisory
- SUSE-SU-2016:2005 vendor-advisory
- SUSE-SU-2016:2006 vendor-advisory
- SUSE-SU-2016:2007 vendor-advisory
- SUSE-SU-2016:2009 vendor-advisory
- SUSE-SU-2016:2010 vendor-advisory
- SUSE-SU-2016:2011 vendor-advisory
- SUSE-SU-2016:2014 vendor-advisory
- SUSE-SU-2016:2018 vendor-advisory
- SUSE-SU-2016:2105 vendor-advisory
- openSUSE-SU-2016:2184 vendor-advisory
- RHSA-2016:1532 third-party-advisory vendor-advisory
- RHSA-2016:1539 third-party-advisory vendor-advisory
- RHSA-2016:1541 third-party-advisory vendor-advisory
- RHSA-2016:1657 vendor-advisory
- RHSA-2016:2006 vendor-advisory
- RHSA-2016:2074 vendor-advisory
- RHSA-2016:2076 vendor-advisory
- RHSA-2016:2128 vendor-advisory
- RHSA-2016:2133 vendor-advisory
- DSA-3607 vendor-advisory
- [oss-security] 20160615 CVE-2016-4470: Linux kernel Uninitialized variable in request_key handling user controlled kfree(). mailing-list
- www.oracle.com third-party-advisory
- www.oracle.com
- www.oracle.com vendor-advisory
- 1036763 vdb-entry
- USN-3049-1 vendor-advisory
- USN-3050-1 vendor-advisory
- USN-3051-1 vendor-advisory
- USN-3052-1 vendor-advisory
- USN-3053-1 vendor-advisory
- USN-3054-1 vendor-advisory
- USN-3055-1 vendor-advisory
- USN-3056-1 vendor-advisory
- USN-3057-1 vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- github.com vendor-advisory