{
  "threat_severity" : "Moderate",
  "public_date" : "2015-11-27T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: Kernel memory disclosure and crash in tty layer",
    "id" : "1296253",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1296253"
  },
  "cvss" : {
    "cvss_base_score" : "5.6",
    "cvss_scoring_vector" : "AV:L/AC:L/Au:N/C:P/I:N/A:C",
    "status" : "draft"
  },
  "cwe" : "CWE-416",
  "details" : [ "Race condition in the tty_ioctl function in drivers/tty/tty_io.c in the Linux kernel through 4.4.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call.", "A use-after-free flaw was discovered in the Linux kernel's tty subsystem, which allows for the disclosure of uncontrolled memory location and possible kernel panic. The information leak is caused by a race condition when attempting to set and read the tty line discipline.  A local attacker could use the TIOCSETD (via tty_set_ldisc) to switch to a new line discipline; a concurrent call to a TIOCGETD ioctl performing a read on a given tty could then access previously allocated memory.  Up to 4 bytes could be leaked when querying the line discipline or the kernel could panic with a NULL-pointer dereference." ],
  "statement" : "This issue affects kernels in Red Hat Enterprise Linux 5, 6 and 7. This has been rated as having Moderate security impact and is not currently\nplanned to be addressed in future updates. For additional information, refer\nto the Red Hat Enterprise Linux Life Cycle:\nhttps://access.redhat.com/support/policy/updates/errata/.",
  "acknowledgement" : "This issue was discovered by Milos Vyletel (Red Hat).",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Will not fix",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Will not fix",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Will not fix",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Will not fix",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise MRG 2",
    "fix_state" : "Will not fix",
    "package_name" : "realtime-kernel",
    "cpe" : "cpe:/a:redhat:enterprise_mrg:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2016-0723\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-0723" ],
  "name" : "CVE-2016-0723",
  "csaw" : false
}