CVE-2016-6197 fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing,....
MediumCVSS 5.5
EPSS 0.51%
- Published
- Updated
- Exploit status
- No public exploit known
Description
fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.6.1-1 | 4.6.1-1 |
| debian/linux(Debian:13) | < 4.6.1-1 | 4.6.1-1 |
| debian/linux(Debian:14) | < 4.6.1-1 | 4.6.1-1 |
| oracle linux | = 6 | No fix listed |
| Linux kernel | <= 4.5.7 | No fix listed |
| oracle vm server | = 3.4 | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-3070-1 vendor-advisory
- USN-3070-4 vendor-advisory
- USN-3070-3 vendor-advisory
- USN-3070-2 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2016-6197 vendor-advisory
- git.kernel.org issue-tracking patch
- RHSA-2016:1847 vendor-advisory
- RHSA-2016:1875 vendor-advisory
- [oss-security] 20160711 Re: cvs request: local DoS using rename syscall on overlayfs on top of xfs to crash the kernel - Linux kernel mailing-list third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com vendor-advisory
- 91709 vdb-entry
- 1036273 vdb-entry
- USN-3070-1 vendor-advisory
- USN-3070-2 vendor-advisory
- USN-3070-3 vendor-advisory
- USN-3070-4 vendor-advisory
- bugzilla.redhat.com issue-tracking
- github.com issue-tracking patch