Main Vulnerability Database Vulnerabilities #VU5833

Integer overflow in Linux kernel - CVE-2016-8636

Published: February 15, 2017 / Updated: February 16, 2017

Vulnerability identifier: #VU5833

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-8636

CWE-ID: CWE-190

Exploitation vector: Local access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local user to cause denial of service and escalate privileges on the system.

The vulnerability exists due to integer overflow in mem_check_range(). A local user can trigger memory corruption and cause denial of service or elevate privileges on vulnerable system

Successful exploitation of this vulnerability may lead to kernel panic or privilege escalation.

Affected software

Linux kernel

How to mitigate CVE-2016-8636

Install update from kernel repository.

Links to Public Exploits and PoC-codes

Exploit #1964 - Integer-Overflow-test (Integer Overflow (CyberSecurity | UMCP 2018) . This involves exploiting integer overflow vulnerability present in mem_check function of infiniband Soft RoCE implemetation (Ref: CVE-2016-8636). It also exploring Pwnie Adventure islan (March 18, 2020)

External References

https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.10

Related Security Bulletins

Multiple vulnerabilities in Linux kernel