CVE-2016-4997
Linux Kernel 4.6.2 (Ubuntu 16.04.1) - 'IP6T_SO_SET_REPLACE' Local Privilege Escalation
Severity Score
7.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
4
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
Las implementaciones de compat IPT_SO_SET_REPLACE y IP6T_SO_SET_REPLACE setsockopt en el subsistema netfilter en el kernel de Linux antes de 4.6.3 permiten a los usuarios locales obtener privilegios o provocar una denegación de servicio (corrupción de memoria) aprovechando el acceso del root en el contenedor para proporcionar un valor de compensación manipulado que desencadena una disminución no intencionada.
A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitrary kernel memory when unloading a kernel module. This action is usually restricted to root-privileged users but can also be leveraged if the kernel is compiled with CONFIG_USER_NS and CONFIG_NET_NS and the user is granted elevated privileges.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-05-24 CVE Reserved
- 2016-06-27 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2024-08-31 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (46)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2016/06/24/5 | Mailing List |
|
| http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html | Third Party Advisory |
|
| http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html | Third Party Advisory |
|
| http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html | Third Party Advisory |
|
| http://www.securityfocus.com/bid/91451 | Third Party Advisory | |
| http://www.securitytracker.com/id/1036171 | Third Party Advisory | |
| https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05347541 | Third Party Advisory | |
| https://www.openwall.com/lists/oss-security/2016/06/24/5 |
|
|
| https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91 |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/40489 | 2024-08-06 | |
| https://www.exploit-db.com/exploits/40435 | 2024-08-06 | |
| http://www.openwall.com/lists/oss-security/2016/09/29/10 | 2024-08-06 | |
| https://github.com/nccgroup/TriforceLinuxSyscallFuzzer/tree/master/crash_reports/report_compatIpt | 2024-08-06 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/torvalds/linux/commit/ce683e5f9d045e5d67d1312a42b359cb2ab2a13c | 2023-09-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 2.6.17 < 3.2.80 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.17 < 3.2.80" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.3 < 3.10.103 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.3 < 3.10.103" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.11 < 3.12.62 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.11 < 3.12.62" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.13 < 3.14.73 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 3.14.73" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.15 < 3.16.37 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.15 < 3.16.37" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.17 < 3.18.37 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.17 < 3.18.37" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.19 < 4.1.28 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.19 < 4.1.28" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 4.4.14 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 4.4.14" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.5 < 4.6.3 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.5 < 4.6.3" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 15.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "15.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Software Development Kit Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Software Development Kit Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" and version "12.0" | sp1 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Desktop Search vendor "Novell" for product "Suse Linux Enterprise Desktop" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Desktop" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Desktop Search vendor "Novell" for product "Suse Linux Enterprise Desktop" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Desktop" and version "12.0" | sp1 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Live Patching Search vendor "Novell" for product "Suse Linux Enterprise Live Patching" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Live Patching" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Module For Public Cloud Search vendor "Novell" for product "Suse Linux Enterprise Module For Public Cloud" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Module For Public Cloud" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Real Time Extension Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Real Time Extension" and version "12.0" | sp1 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "12.0" | sp1 |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Workstation Extension Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" and version "12.0" | - |
Affected
| ||||||
| Novell Search vendor "Novell" | Suse Linux Enterprise Workstation Extension Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Workstation Extension" and version "12.0" | sp1 |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Linux Search vendor "Oracle" for product "Linux" | 7 Search vendor "Oracle" for product "Linux" and version "7" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||