Red Hat, Inc. (AV:L/AC:M/Au:N/C:C/I:C/A:C)

Red Hat, Inc. AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in the Linux kernel's keyring handling code: the key_reject_and_link() function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation.

The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.

https://access.redhat.com/errata/RHSA-2016:1532 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:1539 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:1541 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:1657 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2006 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2074 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2076 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2128 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2133 [No Types Assigned]

https://access.redhat.com/security/cve/CVE-2016-4470 [No Types Assigned]

Red Hat, Inc. (AV:L/AC:M/Au:N/C:C/I:C/A:C)

Red Hat, Inc. AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.

A flaw was found in the Linux kernel's keyring handling code: the key_reject_and_link() function could be forced to free an arbitrary memory block. An attacker could use this flaw to trigger a use-after-free condition on the system, potentially allowing for privilege escalation.

https://access.redhat.com/errata/RHSA-2016:1532 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:1539 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:1541 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:1657 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2006 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2074 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2076 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2128 [No Types Assigned]

https://access.redhat.com/errata/RHSA-2016:2133 [No Types Assigned]

https://access.redhat.com/security/cve/CVE-2016-4470 [No Types Assigned]

OR
     *cpe:2.3:a:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:oracle:linux:7.0:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:oracle:linux:6.0:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

OR
     *cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

http://rhn.redhat.com/errata/RHSA-2016-2006.html [No Types Assigned]

http://rhn.redhat.com/errata/RHSA-2016-2074.html [No Types Assigned]

http://rhn.redhat.com/errata/RHSA-2016-2076.html [No Types Assigned]

http://rhn.redhat.com/errata/RHSA-2016-2128.html [No Types Assigned]

http://rhn.redhat.com/errata/RHSA-2016-2133.html [No Types Assigned]

http://www.securitytracker.com/id/1036763 [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00012.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00013.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00014.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00015.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00016.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00017.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00018.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00019.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00020.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00021.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00022.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00023.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00026.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00027.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html [No Types Assigned]

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html [No Types Assigned]

http://rhn.redhat.com/errata/RHSA-2016-1657.html [No Types Assigned]

http://www.debian.org/security/2016/dsa-3607 [No Types Assigned]

http://www.ubuntu.com/usn/USN-3049-1 [No Types Assigned]

http://www.ubuntu.com/usn/USN-3050-1 [No Types Assigned]

http://www.ubuntu.com/usn/USN-3051-1 [No Types Assigned]

http://www.ubuntu.com/usn/USN-3052-1 [No Types Assigned]

http://www.ubuntu.com/usn/USN-3053-1 [No Types Assigned]

http://www.ubuntu.com/usn/USN-3054-1 [No Types Assigned]

http://www.ubuntu.com/usn/USN-3055-1 [No Types Assigned]

http://www.ubuntu.com/usn/USN-3056-1 [No Types Assigned]

http://www.ubuntu.com/usn/USN-3057-1 [No Types Assigned]

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

Configuration 1
     OR
          *cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*
Configuration 2
     OR
          *cpe:2.3:o:oracle:vm_server:3.3:*:*:*:*:*:*:*
          *cpe:2.3:o:oracle:vm_server:3.4:*:*:*:*:*:*:*
Configuration 3
     OR
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
   

Configuration 1
     OR
          *cpe:2.3:o:oracle:vm_server:3.3:*:*:*:*:*:*:*
          *cpe:2.3:o:oracle:vm_server:3.4:*:*:*:*:*:*:*
Configuration 2
     OR
          *cpe:2.3:o:oracle:linux:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:oracle:linux:6.0:*:*:*:*:*:*:*
          *cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:*
Configuration 3
     OR
          *cpe:2.3:o:linux:linux_kernel:4.6.3:*:*:*:*:*:*:* (and previous)
Configuration 4
     OR
          *cpe:2.3:o:novell:suse_linux_enterprise_real_time_e

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html No Types Assigned

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html Third Party Advisory

Configuration 1
     OR
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_for_real_time:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:ente

Configuration 1
     OR
          *cpe:2.3:o:oracle:vm_server:3.3:*:*:*:*:*:*:*
          *cpe:2.3:o:oracle:vm_server:3.4:*:*:*:*:*:*:*
Configuration 2
     OR
          *cpe:2.3:o:oracle:linux:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:oracle:linux:6.0:*:*:*:*:*:*:*
          *cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:*
Configuration 3
     OR
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
          *c

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html No Types Assigned

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Configuration 1
     OR
          *cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*
Configuration 2
     OR
          *cpe:2.3:o:linux:linux_kernel:4.6.3:*:*:*:*:*:*:* (and previous)
Configuration 3
     OR
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_l

Configuration 1
     OR
          *cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*
Configuration 2
     OR
          *cpe:2.3:o:oracle:vm_server:3.3:*:*:*:*:*:*:*
          *cpe:2.3:o:oracle:vm_server:3.4:*:*:*:*:*:*:*
Configuration 3
     OR
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
   

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html No Types Assigned

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Vendor Advisory

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Configuration 1
     OR
          *cpe:2.3:o:linux:linux_kernel:4.6.3:*:*:*:*:*:*:* (and previous)

Configuration 1
     OR
          *cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*
Configuration 2
     OR
          *cpe:2.3:o:linux:linux_kernel:4.6.3:*:*:*:*:*:*:* (and previous)
Configuration 3
     OR
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node_eus:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*
          *cpe:2.3:o:redhat:enterprise_l

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html No Types Assigned

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1532.html No Types Assigned

http://rhn.redhat.com/errata/RHSA-2016-1532.html Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1539.html No Types Assigned

http://rhn.redhat.com/errata/RHSA-2016-1539.html Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1541.html No Types Assigned

http://rhn.redhat.com/errata/RHSA-2016-1541.html Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1341716 No Types Assigned

https://bugzilla.redhat.com/show_bug.cgi?id=1341716 Third Party Advisory, VDB Entry, Issue Tracking

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html

http://rhn.redhat.com/errata/RHSA-2016-1532.html

http://rhn.redhat.com/errata/RHSA-2016-1539.html

http://rhn.redhat.com/errata/RHSA-2016-1541.html

Configuration 1
     OR
          *cpe:2.3:o:linux:linux_kernel:4.6.3:*:*:*:*:*:*:* (and previous)

(AV:L/AC:L/Au:N/C:N/I:N/A:C)

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD-CWE-Other

<a href="http://cwe.mitre.org/data/definitions/416.html">CWE-416: Use After Free</a>

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=38327424b40bcebe2de92d07312c89360ac9229a No Types Assigned

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=38327424b40bcebe2de92d07312c89360ac9229a Advisory

https://github.com/torvalds/linux/commit/38327424b40bcebe2de92d07312c89360ac9229a No Types Assigned

https://github.com/torvalds/linux/commit/38327424b40bcebe2de92d07312c89360ac9229a Advisory