Use-after-free in Linux kernel - CVE-2016-8655

Vulnerability identifier: #VU90824

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-8655

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free error within the packet_setsockopt() and packet_set_ring() functions in net/packet/af_packet.c. A local user can execute arbitrary code.

Linux kernel
Arch Linux
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Slackware Linux
Fedora
MRG Realtime
linux-grsec
kernel-rt (Red Hat package)
linux-lts
linux-4.4.38/kernel-generic
linux-4.4.38/kernel-huge
linux-4.4.38/kernel-modules
linux-4.4.38/kernel-headers
Linux
linux-zen
kernel

Install update from vendor's website.

linux-grsec - update to 1
kernel-rt (Red Hat package) - addressed in versions 3.10.0-514.rt56.215.el6rt, 3.10.0-514.10.2.rt56.435.el7
linux-lts - update to 4.4.36-1
linux-4.4.38/kernel-generic - update to 4.4.38
linux-4.4.38/kernel-huge - update to 4.4.38
linux-4.4.38/kernel-modules - update to 4.4.38
linux-4.4.38/kernel-headers - update to 4.4.38_smp
Linux - update to 4.8.12-2
linux-zen - update to 4.8.12-2
kernel - addressed in versions 4.8.13-100.fc23, 4.8.13-200.fc24, 4.8.13-300.fc25

• Exploit #9909 - Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation (June 3, 2024)
• Exploit #9908 - Linux 4.4.0 < 4.4.0-53 - AF_PACKET chocobo_root Privilege Escalation (Metasploit) (June 3, 2024)
• Exploit #9907 - Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation (June 3, 2024)
• Exploit #9906 - AF_PACKET chocobo_root Privilege Escalation (June 3, 2024)

• https://bugzilla.redhat.com/show_bug.cgi?id=1400019
• http://www.openwall.com/lists/oss-security/2016/12/06/1
• https://github.com/torvalds/linux/commit/84ac7260236a49c79eede91617700174c2c19b0c
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c
• http://www.securityfocus.com/bid/94692
• https://www.exploit-db.com/exploits/40871/
• http://www.securitytracker.com/id/1037403
• http://packetstormsecurity.com/files/140063/Linux-Kernel-4.4.0-AF_PACKET-Race-Condition-Privilege-Escalation.html
• http://www.ubuntu.com/usn/USN-3152-2
• http://www.ubuntu.com/usn/USN-3152-1
• http://www.ubuntu.com/usn/USN-3151-4
• http://www.ubuntu.com/usn/USN-3151-3
• http://www.ubuntu.com/usn/USN-3151-2
• http://www.ubuntu.com/usn/USN-3151-1
• http://www.ubuntu.com/usn/USN-3150-2
• http://www.ubuntu.com/usn/USN-3150-1
• http://www.ubuntu.com/usn/USN-3149-2
• http://www.ubuntu.com/usn/USN-3149-1
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00087.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00077.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00076.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00073.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00070.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00067.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00056.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00055.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00054.html
• http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00044.html
• https://source.android.com/security/bulletin/2017-03-01.html
• http://www.securitytracker.com/id/1037968
• http://rhn.redhat.com/errata/RHSA-2017-0402.html
• http://rhn.redhat.com/errata/RHSA-2017-0387.html
• http://rhn.redhat.com/errata/RHSA-2017-0386.html
• https://www.exploit-db.com/exploits/44696/

• Use-after-free in Linux kernel packet
• Slackware Linux update for kernel
• Arch Linux update for linux-lts
• Arch Linux update for linux
• Arch Linux update for linux-grsec
• Arch Linux update for linux-zen
• Fedora 25 update for kernel
• Fedora 24 update for kernel
• Fedora 23 update for kernel
• Red Hat Enterprise MRG 2 update for kernel-rt
• Red Hat Enterprise Linux 7 update for kernel-rt