Denial of service in Linux kernel and linux_kernel (Debian package) - CVE-2016-7042
Published: October 17, 2016 / Updated: October 17, 2016
Vulnerability identifier: #VU1012
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-7042
CWE-ID: CWE-131
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Debian
Debian
Affected software:
Linux kernel
linux_kernel (Debian package)
Linux kernel
linux_kernel (Debian package)
Detailed vulnerability description
The vulnerability allows a local user to cause DoS conditions on the target system.
The weakness exists due to using of incorrect buffer size for certain timeout data by the proc_keys_show function in security/keys/proc.c while enabling of GNU Compiler Collection (gcc) stack protector. By reading the /proc/keys file attackers can trigger stack memory corruption.
Successful exploitation of the vulnerability may result in denial of service on the vulnerable system.
The weakness exists due to using of incorrect buffer size for certain timeout data by the proc_keys_show function in security/keys/proc.c while enabling of GNU Compiler Collection (gcc) stack protector. By reading the /proc/keys file attackers can trigger stack memory corruption.
Successful exploitation of the vulnerability may result in denial of service on the vulnerable system.
How to mitigate CVE-2016-7042
Update to version 4.8.2.