CVE-2016-6480

Condición de carrera en la función ioctl_send_fib en drivers/scsi/aacraid/commctrl.c en el kernel de Linux hasta la versión 4.7 permite a usuarios locales provocar una denegación de servicio (acceso fuera de rango o caída de sistema) cambiando un cierto valor de tamaño, también conocido como una vulnerabilidad de "doble recuperación".

A race condition flaw was found in the ioctl_send_fib() function in the Linux kernel's aacraid implementation. A local attacker could use this flaw to cause a denial of service (out-of-bounds access or system crash) by changing a certain size value.

An update that fixes three vulnerabilities is now available. This update for the Linux Kernel 3.12.51-60_20 fixes several issues. The following security bugs were fixed. Race condition in the ioctl_send_fib function in drivers/scsi/aacraid/commctrl.c in the Linux kernel allowed local users to cause a denial of service by changing a certain size value, aka a "double fetch" vulnerability. Multiple heap-based buffer overflows in the hiddev_ioctl_usage function in drivers/hid/usbhid/hiddev.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via a crafted HIDIOCGUSAGES or HIDIOCSUSAGES ioctl call. The compat IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.