CVE-2016-4794
kernel: Use after free in array_map_alloc
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.
Vulnerabilidad de uso después de liberación de memoria en el kernel de Linux hasta la versión 4.6 permite a usuarios locales provocar una denegación de servicio (BUG) o posiblemente tener otro impacto no especificado a través del uso manipulado de llamadas de sistema mmap y bpf.
Use after free vulnerability was found in percpu using previously allocated memory in bpf. First __alloc_percpu_gfp() is called, then the memory is freed with free_percpu() which triggers async pcpu_balance_work and then pcpu_extend_area_map could use a chunk after it has been freed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-05-12 CVE Reserved
- 2016-05-23 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-416: Use After Free
CAPEC
References (13)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/90625 | Third Party Advisory | |
| https://source.android.com/security/bulletin/2016-12-01.html | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2016/05/12/6 | 2024-08-06 | |
| https://lkml.org/lkml/2016/4/17/125 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2016-2574.html | 2023-02-16 | |
| http://rhn.redhat.com/errata/RHSA-2016-2584.html | 2023-02-16 | |
| http://www.ubuntu.com/usn/USN-3053-1 | 2023-02-16 | |
| http://www.ubuntu.com/usn/USN-3054-1 | 2023-02-16 | |
| http://www.ubuntu.com/usn/USN-3055-1 | 2023-02-16 | |
| http://www.ubuntu.com/usn/USN-3056-1 | 2023-02-16 | |
| http://www.ubuntu.com/usn/USN-3057-1 | 2023-02-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1335889 | 2016-11-03 | |
| https://access.redhat.com/security/cve/CVE-2016-4794 | 2016-11-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.18 < 3.18.37 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.18 < 3.18.37" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.19 < 4.1.28 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.19 < 4.1.28" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 4.4.16 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 4.4.16" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.5 < 4.6.5 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.5 < 4.6.5" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||