// For flags

CVE-2016-4998

Linux Kernel 4.6.3 Netfilter Privilege Escalation

Severity Score

7.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.

La implementación de setsockopt IPT_SO_SET_REPLACEIPT_SO_SET_REPLACE en el subsistema de netfilter en el kernel de Linux en versiones anteriores a 4.6 permite a usuarios locales provocar una denegación de servicio (lectura fuera de límites) o posiblemente obtener información sensible de la memoria dinámica del kernel aprovechando el acceso root en el contenedor para proporcionar un valor de desplazamiento manipulado que lleva a cruzar un conjunto de reglas de un límite blob.

An out-of-bounds heap memory access leading to a Denial of Service, heap disclosure, or further impact was found in setsockopt(). The function call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw in privileged container environments.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-05-24 CVE Reserved
  • 2016-06-03 First Exploit
  • 2016-06-27 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-122: Heap-based Buffer Overflow
CAPEC
References (32)
URL Tag Source
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91 X_refsource_confirm
http://www.openwall.com/lists/oss-security/2016/06/24/5 Mailing List
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html X_refsource_confirm
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html X_refsource_confirm
http://www.securityfocus.com/bid/91451 Vdb Entry
http://www.securitytracker.com/id/1036171 Vdb Entry
https://www.openwall.com/lists/oss-security/2016/06/24/5
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d045e5d67d1312a42b359cb2ab2a13c
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91
URL Date SRC
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb 2016-06-03
URL Date SRC
https://github.com/torvalds/linux/commit/6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91 2023-02-12
URL Date SRC
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html 2023-02-12
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html 2023-02-12
http://rhn.redhat.com/errata/RHSA-2016-1847.html 2023-02-12
http://rhn.redhat.com/errata/RHSA-2016-1875.html 2023-02-12
http://rhn.redhat.com/errata/RHSA-2016-1883.html 2023-02-12
http://rhn.redhat.com/errata/RHSA-2017-0036.html 2023-02-12
http://www.debian.org/security/2016/dsa-3607 2023-02-12
http://www.ubuntu.com/usn/USN-3016-1 2023-02-12
http://www.ubuntu.com/usn/USN-3016-2 2023-02-12
http://www.ubuntu.com/usn/USN-3016-3 2023-02-12
http://www.ubuntu.com/usn/USN-3016-4 2023-02-12
http://www.ubuntu.com/usn/USN-3017-1 2023-02-12
http://www.ubuntu.com/usn/USN-3017-2 2023-02-12
http://www.ubuntu.com/usn/USN-3017-3 2023-02-12
http://www.ubuntu.com/usn/USN-3018-1 2023-02-12
http://www.ubuntu.com/usn/USN-3018-2 2023-02-12
http://www.ubuntu.com/usn/USN-3019-1 2023-02-12
http://www.ubuntu.com/usn/USN-3020-1 2023-02-12
https://bugzilla.redhat.com/show_bug.cgi?id=1349886 2017-01-10
https://access.redhat.com/security/cve/CVE-2016-4998 2017-01-10
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 <= 4.5.5
Search vendor "Linux" for product "Linux Kernel" and version " <= 4.5.5"
-
Affected
Oracle
Search vendor "Oracle"
 Linux
Search vendor "Oracle" for product "Linux"
 7
Search vendor "Oracle" for product "Linux" and version "7"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 12.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"
lts
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 14.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04"
lts
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 15.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "15.10"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 16.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04"
lts
Affected