Denial of service in Linux kernel and linux_kernel (Debian package) - CVE-2016-8660
Published: October 17, 2016 / Updated: October 17, 2016
Vulnerability identifier: #VU1006
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-8660
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Debian
Debian
Affected software:
Linux kernel
linux_kernel (Debian package)
Linux kernel
linux_kernel (Debian package)
Detailed vulnerability description
The vulnerability allows a local nonprivileged user to cause DoS conditions on the target system.
The weakness exists due to insufficient access control. By using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation", attackers can trigger fdatasync failure and system hang.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.
The weakness exists due to insufficient access control. By using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation", attackers can trigger fdatasync failure and system hang.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.
How to mitigate CVE-2016-8660
Update to version 4.8.2.