Denial of service in Linux kernel and linux_kernel (Debian package) - CVE-2016-8660
Published: October 17, 2016 / Updated: October 17, 2016
Vulnerability identifier: #VU1006
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8660
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local nonprivileged user to cause DoS conditions on the target system.
The weakness exists due to insufficient access control. By using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation", attackers can trigger fdatasync failure and system hang.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.
The weakness exists due to insufficient access control. By using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation", attackers can trigger fdatasync failure and system hang.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.
Affected software
Linux kernel
linux_kernel (Debian package)
linux_kernel (Debian package)
How to mitigate CVE-2016-8660
Update to version 4.8.2.