CVE-2016-4998 The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensi...
HighCVSS 7.1
EPSS 1.9%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.6.2-2 | 4.6.2-2 |
| debian/linux(Debian:13) | < 4.6.2-2 | 4.6.2-2 |
| debian/linux(Debian:14) | < 4.6.2-2 | 4.6.2-2 |
| Linux kernel | <= 4.5.5 | No fix listed |
| oracle linux | = 7 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.10 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
References
- Debian Security Tracker CVE-2016-4998 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-3016-1 vendor-advisory
- USN-3016-2 vendor-advisory
- USN-3017-1 vendor-advisory
- USN-3017-3 vendor-advisory
- USN-3016-3 vendor-advisory
- USN-3016-4 vendor-advisory
- USN-3017-2 vendor-advisory
- USN-3020-1 vendor-advisory
- USN-3018-2 vendor-advisory
- USN-3018-1 vendor-advisory
- USN-3019-1 vendor-advisory
- www.cve.org
- git.kernel.org
- SUSE-SU-2016:2105 vendor-advisory
- openSUSE-SU-2016:2184 vendor-advisory
- RHSA-2016:1847 vendor-advisory
- RHSA-2016:1875 vendor-advisory
- RHSA-2016:1883 vendor-advisory
- RHSA-2017:0036 vendor-advisory
- DSA-3607 vendor-advisory
- [oss-security] 20160624 Linux CVE-2016-4997 (local privilege escalation) and CVE-2016-4998 (out of bounds memory access) mailing-list
- www.oracle.com third-party-advisory
- www.oracle.com
- www.oracle.com
- 91451 vdb-entry
- 1036171 vdb-entry
- USN-3016-1 third-party-advisory vendor-advisory
- USN-3016-2 third-party-advisory vendor-advisory
- USN-3016-3 third-party-advisory vendor-advisory
- USN-3016-4 third-party-advisory vendor-advisory
- USN-3017-1 third-party-advisory vendor-advisory
- USN-3017-2 third-party-advisory vendor-advisory
- USN-3017-3 third-party-advisory vendor-advisory
- USN-3018-1 third-party-advisory vendor-advisory
- USN-3018-2 third-party-advisory vendor-advisory
- USN-3019-1 third-party-advisory vendor-advisory
- USN-3020-1 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry
- github.com patch vendor-advisory