Privilege escalation in Linux kernel - CVE-2016-7425
Published: October 17, 2016 / Updated: May 30, 2020
Vulnerability identifier: #VU1009
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-7425
CWE-ID: CWE-805
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain elevated privileges on the target system.
The weakness is due to insufficient restriction of length field by arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c. By sending an ARCMSR_MESSAGE_WRITE_WQBUFFER control code, attackers can gain elevated privileges and trigger a heap-based buffer overflow.
Success fule exploitation of the vulnerability may result in denial of service on the vulnerable system.
The weakness is due to insufficient restriction of length field by arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c. By sending an ARCMSR_MESSAGE_WRITE_WQBUFFER control code, attackers can gain elevated privileges and trigger a heap-based buffer overflow.
Success fule exploitation of the vulnerability may result in denial of service on the vulnerable system.
Affected software
Linux kernel
Ubuntu
Fedora
linux (Ubuntu package)
kernel
Ubuntu
Fedora
linux (Ubuntu package)
kernel
How to mitigate CVE-2016-7425
Update to version 4.8.2.
Linux kernel - update to 4.1.37
linux (Ubuntu package) - update to 4.4.0-51.72
kernel - update to 4.8.0-0.rc7.git0.1.fc25
linux (Ubuntu package) - update to 4.4.0-51.72
kernel - update to 4.8.0-0.rc7.git0.1.fc25