CVE-2016-4470
Description
A flaw was found in the Linux kernel's keyring handling code: the key_reject_and_link() function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation.
Statement
This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 6 and may be addressed in a future update.
This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and Red Hat Enterprise MRG 2 as the due updates to fix this issue have been shipped now.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | None | N/A |
| Integrity Impact | High | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.9 | 4.9 | N/A |
| Attack Vector | Local | Local | N/A |
| Access Complexity | Medium | Low | N/A |
| Authentication | None | None | N/A |
| Confidentiality Impact | Complete | None | N/A |
| Integrity Impact | Complete | None | N/A |
| Availability Impact | Complete | Complete | N/A |
Vector
Red Hat: AV:L/AC:M/Au:N/C:C/I:C/A:C
NVD: AV:L/AC:L/Au:N/C:N/I:N/A:C
Understanding the Weakness (CWE)
Availability,Integrity
Technical Impact: Unexpected State; DoS: Crash, Exit, or Restart
An unexpected return value could place the system in a state that could lead to a crash or other unintended behaviors.
Acknowledgements
This issue was discovered by David Howells (Red Hat).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
