CVE-2016-9793
Linux Kernel 3.11 < 4.8 0 - 'SO_SNDBUFFORCE' / 'SO_RCVBUFFORCE' Local Privilege Escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option.
La función sock_setsockopt en net/core/sock.c en el kernel de Linux en versiones anteriores a 4.8.14 no maneja adecuadamente valores negativos de sk_sndbuf y sk_rcvbuf, lo que permite a usuarios locales provocar una denegación de servicio (corrupción de memoria y caída del sistema) o posiblemente tener otros impactos no especificados aprovechando la capacidad CAP_NET_ADMIN para una llamada al sistema setsockopt manipulada con la opción (1) SO_SNDBUFFORCE o (2) SO_RCVBUFFORCE.
A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative. This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-12-02 CVE Reserved
- 2016-12-28 CVE Published
- 2017-03-22 First Exploit
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (14)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/94655 | Third Party Advisory | |
| http://www.securitytracker.com/id/1037968 | Third Party Advisory | |
| https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793 | Third Party Advisory | |
| https://source.android.com/security/bulletin/2017-03-01.html | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/41995 | 2017-03-22 |
| URL | Date | SRC |
|---|---|---|
| http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.14 | 2023-01-17 | |
| https://access.redhat.com/errata/RHSA-2017:0931 | 2023-01-17 | |
| https://access.redhat.com/errata/RHSA-2017:0932 | 2023-01-17 | |
| https://access.redhat.com/errata/RHSA-2017:0933 | 2023-01-17 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1402013 | 2017-04-12 | |
| https://access.redhat.com/security/cve/CVE-2016-9793 | 2017-04-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.5 < 3.12.69 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.5 < 3.12.69" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.13 < 3.16.40 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 3.16.40" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.17 < 3.18.52 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.17 < 3.18.52" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.19 < 4.1.50 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.19 < 4.1.50" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.2 < 4.4.38 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.2 < 4.4.38" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.5 < 4.8.14 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.5 < 4.8.14" | - |
Affected
| ||||||