CVE-2016-4998

Impact:
Moderate
Public Date:
2016-06-24
CWE:
CWE-122
Bugzilla:
1349886: CVE-2016-4998 kernel: out of bounds reads when processing IPT_SO_SET_REPLACE setsockopt
An out-of-bounds heap memory access leading to a Denial of Service, heap disclosure, or further impact was found in setsockopt(). The function call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw in privileged container environments.

Find out more about CVE-2016-4998 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 5.6
Base Metrics AV:L/AC:L/Au:N/C:P/I:N/A:C
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact None
Availability Impact Complete

CVSS v3 metrics

CVSS3 Base Score 6.1
CVSS3 Base Metrics CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Impact None
Availability Impact High

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 7 (kernel) RHSA-2016:1847 2016-09-15
Red Hat Enterprise Linux for Real Time for NFV (v. 7) (kernel-rt) RHSA-2016:1875 2016-09-15
Red Hat Enterprise Linux 6 (kernel) RHSA-2017:0036 2017-01-10
Red Hat MRG Grid for RHEL 6 Server v.2 (kernel-rt) RHSA-2016:1883 2016-09-14

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 5 kernel Not affected
Last Modified