Null pointer dereference in Linux kernel - CVE-2016-8646
Published: May 25, 2017 / Updated: May 30, 2017
Vulnerability identifier: #VU6727
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8646
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause DoS condition on the target system.
The weakness exists due to NULL pointer dereference in the hash_accept function in crypto/algif_hash.c. A local attacker can trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data and cause a kernel oops.
Successful exploitation of the vulnerability results in denial of service.
The weakness exists due to NULL pointer dereference in the hash_accept function in crypto/algif_hash.c. A local attacker can trigger use of in-kernel hash algorithms for a socket that has received zero bytes of data and cause a kernel oops.
Successful exploitation of the vulnerability results in denial of service.
Affected software
Linux kernel
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
CentOS
MRG Realtime
kernel (Red Hat package)
kernel-rt (Red Hat package)
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
CentOS
MRG Realtime
kernel (Red Hat package)
kernel-rt (Red Hat package)
How to mitigate CVE-2016-8646
Update to version 4.3.6.
kernel (Red Hat package) - update to 3.10.0-514.21.1.el7
kernel-rt (Red Hat package) - addressed in versions 3.10.0-514.rt56.221.el6rt, 3.10.0-514.21.1.rt56.438.el7
kernel-rt (Red Hat package) - addressed in versions 3.10.0-514.rt56.221.el6rt, 3.10.0-514.21.1.rt56.438.el7