CVE-2016-5243

La función tipc_nl_compat_link_dump en net/tipc/netlink_compat.c en el kernel de Linux hasta la versión 4.6.3 no copia adecuadamente una cierta cadena, lo que permite a usuarios locales obtener información sensible de la memoria de pila del kernel leyendo un mensaje Netlink.

Ben Hawkes discovered an integer overflow in the Linux netfilter implementation. On systems running 32 bit kernels, a local unprivileged attacker could use this to cause a denial of service or possibly execute arbitrary code with administrative privileges. It was discovered that the keyring implementation in the Linux kernel did not ensure a data structure was initialized before referencing it after an error condition occurred. A local attacker could use this to cause a deni al of service. Various other issues were also addressed.