CVE-2016-9604
kernel: security: The built-in keyrings for security tokens can be joined as a session and then modified by the root user
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.
Se ha descubierto en el kernel de Linux en versiones anteriores a la 4.11-rc8 que root puede obtener acceso directo a un keyring interno, como ".dns_resolver" en RHEL-7 o el upstream ".builtin_trusted_keys" uniéndose a él como su keyring de sesión. Esto permite que root omita la verificación de firmas del módulo añadiendo una nueva clave pública de su propia elaboración al keyring.
It was discovered that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-11-23 CVE Reserved
- 2017-06-07 CVE Published
- 2023-07-05 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-347: Improper Verification of Cryptographic Signature
- CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-9604.html | Third Party Advisory | |
| http://www.securityfocus.com/bid/102135 | Third Party Advisory | |
| https://bugzilla.novell.com/show_bug.cgi?id=1035576 | Issue Tracking | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9604 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee8f844e3c5a73b999edf733df1c529d6503ec2f | 2023-11-07 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2017:1842 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:2077 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:2669 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2016-9604 | 2017-09-06 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1389433 | 2017-09-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | <= 4.11 Search vendor "Linux" for product "Linux Kernel" and version " <= 4.11" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.11 Search vendor "Linux" for product "Linux Kernel" and version "4.11" | rc1 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.11 Search vendor "Linux" for product "Linux Kernel" and version "4.11" | rc2 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.11 Search vendor "Linux" for product "Linux Kernel" and version "4.11" | rc3 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.11 Search vendor "Linux" for product "Linux Kernel" and version "4.11" | rc4 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.11 Search vendor "Linux" for product "Linux Kernel" and version "4.11" | rc5 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.11 Search vendor "Linux" for product "Linux Kernel" and version "4.11" | rc6 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 4.11 Search vendor "Linux" for product "Linux Kernel" and version "4.11" | rc7 |
Affected
| ||||||