CVE-2016-4470

Impact:
Important
Public Date:
2016-06-15
CWE:
CWE-253
Bugzilla:
1341716: CVE-2016-4470 kernel: Uninitialized variable in request_key handling causes kernel crash in error handling path
A flaw was found in the Linux kernel's keyring handling code: the key_reject_and_link() function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation.

Find out more about CVE-2016-4470 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 6 and may be addressed in a future update.

This issue does not affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 7 and Red Hat Enterprise MRG 2 as the due updates to fix
this issue have been shipped now.

CVSS v2 metrics

Base Score 6.9
Base Metrics AV:L/AC:M/Au:N/C:C/I:C/A:C
Access Vector Local
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete

CVSS v3 metrics

CVSS3 Base Score 7.8
CVSS3 Base Metrics CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity Impact High
Availability Impact High

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux Advanced Update Support 6.5 (kernel) RHSA-2016:2074 2016-10-18
Red Hat MRG Grid for RHEL 6 Server v.2 (kernel-rt) RHSA-2016:1532 2016-08-02
Red Hat Enterprise Linux 7 (kernel) RHSA-2016:1539 2016-08-02
Red Hat Enterprise Linux Advanced Update Support 6.4 (kernel) RHSA-2016:2133 2016-11-01
Red Hat Enterprise Linux Extended Update Support 6.6 (kernel) RHSA-2016:2128 2016-10-31
Red Hat Enterprise Linux Extended Update Support 7.1 (kernel) RHSA-2016:1657 2016-08-23
Red Hat Enterprise Linux Extended Update Support 6.7 (kernel) RHSA-2016:2076 2016-10-18
Red Hat Enterprise Linux 6 (kernel) RHSA-2016:2006 2016-10-04
Red Hat Enterprise Linux for Real Time for NFV (v. 7) (kernel-rt) RHSA-2016:1541 2016-08-02
Unless explicitly stated as not affected, all previous versions of packages in any minor update stream of a product listed here should be assumed vulnerable, although may not have been subject to full analysis.

Acknowledgements

This issue was discovered by David Howells (Red Hat).
Last Modified