Denial of service in Oracle products - CVE-2016-6327

Vulnerability identifier: #VU1013

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6327

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause DoS conditions on the target system.
The weakness is caused by drivers/infiniband/ulp/srpt/ib_srpt.c. By using an ABORT_TASK command attackers can abort a device write operation that leads to NULL pointer dereference and system crash.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Linux kernel
Oracle Linux
Oracle VM Server for x86

Update to version 4.5.1.

• https://bugzilla.redhat.com/show_bug.cgi?id=1354525
• http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

• Denial of service in Linux kernel