Permissions, privileges, and access controls in Linux kernel - CVE-2016-6786

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU92445

Permissions, privileges, and access controls in Linux kernel - CVE-2016-6786

Published: December 28, 2016 / Updated: June 7, 2023


Vulnerability identifier: #VU92445
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-6786
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel

Detailed vulnerability description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to permissions, privileges, and access controls error within the put_ctx(), __perf_event_disable(), raw_spin_unlock_irq(), perf_event_enable(), perf_event_refresh(), perf_remove_from_owner(), perf_event_read_group(), perf_read(), perf_poll(), perf_event_for_each_child(), perf_event_for_each(), perf_event_set_output(), perf_ioctl(), perf_compat_ioctl(), perf_event_task_enable(), mutex_lock_double(), syscall_define5() and perf_pmu_migrate_context() functions in kernel/events/core.c. A local user can execute arbitrary code.


How to mitigate CVE-2016-6786

Install update from vendor's repository.

Sources