Denial of service in Linux kernel and linux_kernel (Debian package) - CVE-2016-7042
Published: October 17, 2016 / Updated: October 17, 2016
Vulnerability identifier: #VU1012
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-7042
CWE-ID: CWE-131
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause DoS conditions on the target system.
The weakness exists due to using of incorrect buffer size for certain timeout data by the proc_keys_show function in security/keys/proc.c while enabling of GNU Compiler Collection (gcc) stack protector. By reading the /proc/keys file attackers can trigger stack memory corruption.
Successful exploitation of the vulnerability may result in denial of service on the vulnerable system.
The weakness exists due to using of incorrect buffer size for certain timeout data by the proc_keys_show function in security/keys/proc.c while enabling of GNU Compiler Collection (gcc) stack protector. By reading the /proc/keys file attackers can trigger stack memory corruption.
Successful exploitation of the vulnerability may result in denial of service on the vulnerable system.
Affected software
Linux kernel
Ubuntu
linux_kernel (Debian package)
Ubuntu
linux_kernel (Debian package)
How to mitigate CVE-2016-7042
Update to version 4.8.2.