Use-after-free error in Linux kernel - CVE-2016-0728

Vulnerability identifier: #VU2513

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-0728

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to use-after-free error in the join_session_keyring() function in security/keys/process_keys.c when handling keyring object reference counting by Linux kernel's key management subsystem. A local attacker can overflow the usage field via a specially crafted object and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Note: the vulnerability was being actively exploited.

Linux kernel
Amazon Linux AMI
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server from RHUI
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
SUSE Linux
Ubuntu
Fedora

kernel (Red Hat package)
linux-grsec (Alpine package)
kernel-rt (Red Hat package)
kernel

Update to version 4.4.1.

kernel (Red Hat package) - update to 3.10.0-327.4.5.el7
kernel-rt (Red Hat package) - update to 3.10.0-327.4.5.rt56.206.el7_2
kernel - addressed in versions 4.3.3-200.fc22, 4.3.3-303.fc23

• Exploit #8641 - cve-2016-0728 (Exploit from perception point ) (December 4, 2022)
• Exploit #2661 - Linux-Vulnerability-CVE-2016-0728-and-Exploit (Document on Linux Kernal Vulnerability CVE-2016-0728 and Exploitation) (May 13, 2020)
• Exploit #2322 - cve-2016-0728 (a exploit for cve-2016-0728) (April 7, 2020)
• Exploit #2329 - exploit_cve-2016-0728 (vagrant box exploiting cve-2016-0728) (April 7, 2020)
• Exploit #2268 - cve_2016_0728_exploit (3.8+ linux root exploit) (April 7, 2020)
• Exploit #2203 - lem (Linux Exploit Mapper correlates CVEs local to a Linux system with known exploits) (March 18, 2020)
• Exploit #110 - CVE-2016-0728 (cve-2016-0728 exploit and summary) (March 18, 2020)
• Exploit #632 - Linux Kernel 4.4.1 - REFCOUNT Overflow/Use-After-Free in Keyrings Privilege Escalation (2) (March 18, 2020)
• Exploit #633 - Linux Kernel 4.4.1 - REFCOUNT Overflow/Use-After-Free in Keyrings Privilege Escalation (1) (March 18, 2020)

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a50597de8635cd05133bd12c9...
• http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-...

• Privilege escalation in Linux kernel
• Ubuntu update for Linux kernel (Trusty HWE)
• Ubuntu update for Linux kernel (Raspberry Pi 2)
• Ubuntu update for Linux kernel (Wily HWE)
• Ubuntu update for Linux kernel (Vivid HWE)
• Ubuntu update for Linux kernel (Utopic HWE)
• Ubuntu update for Linux kernel
• Ubuntu update for Linux kernel
• Ubuntu update for Linux kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for the Linux Kernel
• SUSE Linux update for Kernel live patch 10
• Amazon Linux AMI update for kernel
• Red Hat update for kernel-rt
• Red Hat update for kernel
• Use-after-free error in linux-grsec (Alpine package)
• Fedora 22 update for kernel
• Fedora 23 update for kernel