Linux Kernel 4.4.1 – REFCOUNT Overflow/Use-After-Free in Keyrings Privilege Escalation vulnerability
by CIRT Team
Description:
CVE-2016-0728: The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.
Impact: Local attackers may exploit this issue to gain root privileges.
Mitigation: Vendor has released patch version.
Reference URL’s:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0728
- https://access.redhat.com/security/cve/cve-2016-0728
- https://security-tracker.debian.org/tracker/CVE-2016-0728
- https://www.suse.com/security/cve/CVE-2016-0728/
Recommended Posts
Cyber Threat Alert: Surge in Attacks via Compromised Third-Party Service Providers
08 Feb 2024 - Articles, English articles, Security Advisories & Alerts
Subscribe here
MEMBER OF:
