Privilege escalation in Linux kernel - CVE-2016-7425
Published: October 17, 2016 / Updated: May 30, 2020
Vulnerability identifier: #VU1009
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-7425
CWE-ID: CWE-805
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to gain elevated privileges on the target system.
The weakness is due to insufficient restriction of length field by arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c. By sending an ARCMSR_MESSAGE_WRITE_WQBUFFER control code, attackers can gain elevated privileges and trigger a heap-based buffer overflow.
Success fule exploitation of the vulnerability may result in denial of service on the vulnerable system.
The weakness is due to insufficient restriction of length field by arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c. By sending an ARCMSR_MESSAGE_WRITE_WQBUFFER control code, attackers can gain elevated privileges and trigger a heap-based buffer overflow.
Success fule exploitation of the vulnerability may result in denial of service on the vulnerable system.
How to mitigate CVE-2016-7425
Update to version 4.8.2.