CVE-2013-4312
published 2016-02-08CVE-2013-4312: The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor…
PriorityP421medium6.2CVSS 3.0
AVLACLPRNUINSUCNINAH
EPSS
0.60%
44.9th percentile
The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.4.4-1 (bookworm) | linux 4.4.4-1 (bookworm) |
| debian | linux | < linux 4.3.3-6 (bookworm) | linux 4.3.3-6 (bookworm) |
| linux | linux_kernel | <= 4.4.8 | — |
| linux | linux_kernel | <= 4.4 | — |
| linux | linux_kernel | >= 0 < 4.4.4-1 | 4.4.4-1 |
| linux | linux_kernel | >= 0 < 4.3.3-6 | 4.3.3-6 |
| linux | linux_kernel | >= 0 < 4.4.4-1 | 4.4.4-1 |
| linux | linux_kernel | >= 0 < 4.3.3-6 | 4.3.3-6 |
| linux | linux_kernel | >= 0 < 4.4.4-1 | 4.4.4-1 |
| linux | linux_kernel | >= 0 < 4.3.3-6 | 4.3.3-6 |
| linux | linux_kernel | >= 0 < 4.4.4-1 | 4.4.4-1 |
| linux | linux_kernel | >= 0 < 4.3.3-6 | 4.3.3-6 |
| linux | linux_kernel | >= 0 < 3.13.0-83.127 | 3.13.0-83.127 |
| oracle | linux | — | — |
| oracle | linux | — | — |
| oracle | linux | — | — |
CVSS provenance
nvdv3.06.2MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv6.2MEDIUM
vendor_debian6.2MEDIUM
vendor_redhat6.2MEDIUM
vendor_ubuntu6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w67r-pc7p-x294: The Linux kernel before 4
ghsa_unreviewed·2022-05-14·CVSS 6.2
CVE-2016-2550 [MEDIUM] GHSA-w67r-pc7p-x294: The Linux kernel before 4
The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.
GHSA
GHSA-vqj4-45vx-v6r9: The Linux kernel before 4
ghsa_unreviewed·2022-05-13
CVE-2013-4312 [MEDIUM] CWE-119 GHSA-vqj4-45vx-v6r9: The Linux kernel before 4
The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.
OSV
CVE-2016-2550: The Linux kernel before 4
osv·2016-04-27·CVSS 6.2
CVE-2016-2550 [MEDIUM] CVE-2016-2550: The Linux kernel before 4
The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.
OSV
linux-lts-vivid vulnerabilities
osv·2016-03-14·CVSS 6.2
CVE-2016-3134 [MEDIUM] linux-lts-vivid vulnerabilities
linux-lts-vivid vulnerabilities
Ben Hawkes discovered that the Linux netfilter implementation did not
correctly perform validation when handling IPT_SO_SET_REPLACE events. A
local unprivileged attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code with administrative
privileges. (CVE-2016-3134)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7566)
Ralf
OSV
linux-lts-utopic vulnerabilities
osv·2016-03-14·CVSS 6.2
CVE-2016-3134 [MEDIUM] linux-lts-utopic vulnerabilities
linux-lts-utopic vulnerabilities
Ben Hawkes discovered that the Linux netfilter implementation did not
correctly perform validation when handling IPT_SO_SET_REPLACE events. A
local unprivileged attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code with administrative
privileges. (CVE-2016-3134)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
It was discovered that a race condition existed when handling heartbeat-
timeout events in the SCTP implementation of the Linux kernel. A remote
attacker could use this to cause a denial of service. (CVE-2015-8767)
Andy Lutomirski discovered a race
OSV
linux vulnerabilities
osv·2016-03-14·CVSS 6.2
CVE-2016-3134 [MEDIUM] linux vulnerabilities
linux vulnerabilities
Ben Hawkes discovered that the Linux netfilter implementation did not
correctly perform validation when handling IPT_SO_SET_REPLACE events. A
local unprivileged attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code with administrative
privileges. (CVE-2016-3134)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7566)
Ralf Spenneber
OSV
linux-lts-wily regression
osv·2016-02-27·CVSS 6.2
[MEDIUM] linux-lts-wily regression
linux-lts-wily regression
USN-2908-2 fixed vulnerabilities in the Ubuntu 15.10 Linux kernel
backported to Ubuntu 14.04 LTS. An incorrect locking fix caused a
regression that broke graphics displays for Ubuntu 14.04 LTS guests
running the Ubuntu 15.10 backport kernel within VMWare virtual
machines. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as POSIX ACLs. A
local unprivileged attacker could use this to gain
OSV
linux-lts-wily vulnerabilities
osv·2016-02-22·CVSS 6.2
CVE-2016-1576 [MEDIUM] linux-lts-wily vulnerabilities
linux-lts-wily vulnerabilities
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as POSIX ACLs. A
local unprivileged attacker could use this to gain privileges.
(CVE-2016-1575)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
It was discovered that the Linux kernel's Filesystem in Userspace (FUSE)
implementation did not handle initial zero length segments
OSV
CVE-2013-4312: The Linux kernel before 4
osv·2016-02-08·CVSS 6.2
CVE-2013-4312 [MEDIUM] CVE-2013-4312: The Linux kernel before 4
The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.
Kernel
pipe: limit the per-user amount of pages allocated in pipes
kernel_security·2016-01-18·CVSS 6.2
CVE-2013-4312 [MEDIUM] pipe: limit the per-user amount of pages allocated in pipes
pipe: limit the per-user amount of pages allocated in pipes
On no-so-small systems, it is possible for a single process to cause an
OOM condition by filling large pipes with data that are never read. A
typical process filling 4000 pipes with 1 MB of data will use 4 GB of
memory. On small systems it may be tricky to set the pipe max size to
prevent this from happening.
This patch makes it possible to enforce a per-user soft limit above
which new pipes will be limited to a single page, effectively limiting
them to 4 kB each, as well as a hard limit above which no new pipes may
be created for this user. This has the effect of protecting the system
against memory abuse without hurting other users, and still allowing
pipes to work correctly though with less data at once.
The limit are contro
Kernel
unix: properly account for FDs passed over unix sockets
kernel_security·2016-01-10·CVSS 6.2
CVE-2013-4312 [MEDIUM] unix: properly account for FDs passed over unix sockets
unix: properly account for FDs passed over unix sockets
It is possible for a process to allocate and accumulate far more FDs than
the process' limit by sending them over a unix socket then closing them
to keep the process' fd count low.
This change addresses this problem by keeping track of the number of FDs
in flight per user and preventing non-privileged processes from having
more FDs in flight than their configured FD limit.
Reported-by: [email protected]
Reported-by: Tetsuo Handa
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: Linus Torvalds
Acked-by: Hannes Frederic Sowa
Signed-off-by: Willy Tarreau
Signed-off-by: David S. Miller
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-05-09·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7515)
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7566)
Ral
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2016-05-09·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7515)
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-75
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2016-03-14·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Ben Hawkes discovered that the Linux netfilter implementation did not
correctly perform validation when handling IPT_SO_SET_REPLACE events. A
local unprivileged attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code with administrative
privileges. (CVE-2016-3134)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-03-14·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Ben Hawkes discovered that the Linux netfilter implementation did not
correctly perform validation when handling IPT_SO_SET_REPLACE events. A
local unprivileged attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code with administrative
privileges. (CVE-2016-3134)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could
Ubuntu
Linux kernel (Vivid HWE) vulnerabilities
vendor_ubuntu·2016-03-14·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel (Vivid HWE) vulnerabilities
Title: Linux kernel (Vivid HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Ben Hawkes discovered that the Linux netfilter implementation did not
correctly perform validation when handling IPT_SO_SET_REPLACE events. A
local unprivileged attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code with administrative
privileges. (CVE-2016-3134)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities
vendor_ubuntu·2016-03-14·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel (Utopic HWE) vulnerabilities
Title: Linux kernel (Utopic HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Ben Hawkes discovered that the Linux netfilter implementation did not
correctly perform validation when handling IPT_SO_SET_REPLACE events. A
local unprivileged attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code with administrative
privileges. (CVE-2016-3134)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
It was discovered that a race condition existed when handling heartbeat-
timeout events in the SCTP implementation of the Linux kernel. A remote
attacker could use this to c
Ubuntu
Linux kernel (Wily HWE) regression
vendor_ubuntu·2016-02-27·CVSS 6.2
[MEDIUM] Linux kernel (Wily HWE) regression
Title: Linux kernel (Wily HWE) regression
Summary: USN-2908-2 introduced a regression in the Ubuntu 15.10 Linux kernel
backported to Ubuntu 14.04 LTS.
USN-2908-2 fixed vulnerabilities in the Ubuntu 15.10 Linux kernel
backported to Ubuntu 14.04 LTS. An incorrect locking fix caused a
regression that broke graphics displays for Ubuntu 14.04 LTS guests
running the Ubuntu 15.10 backport kernel within VMWare virtual
machines. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectl
Ubuntu
Linux kernel regression
vendor_ubuntu·2016-02-26·CVSS 6.2
[MEDIUM] Linux kernel regression
Title: Linux kernel regression
Summary: USN-2908-1 introduced a regression in the Linux kernel.
USN-2908-1 fixed vulnerabilities in the Linux kernel for Ubuntu
15.10. An incorrect locking fix caused a regression that broke
graphics displays for Ubuntu 15.10 guests running within VMWare
virtual machines. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as POSIX ACLs. A
local unprivileged attacker could use this t
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2016-02-22·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as POSIX ACLs. A
local unprivileged attacker could use this to gain privileges.
(CVE-2016-1575)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
It was discovered that the Linux kernel's Filesyst
Red Hat
kernel: incorrectly accounted in-flight fds
vendor_redhat·2016-02-22·CVSS 6.2
CVE-2016-2550 [MEDIUM] CWE-400 kernel: incorrectly accounted in-flight fds
kernel: incorrectly accounted in-flight fds
The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.
A resource-exhaustion vulnerability was found in the kernel, where an unprivileged process could allocate and accumulate far more file descriptors than the process' limit. A local, unauthenticated user could exploit this flaw by sending file descriptors over a Unix socket and then closing them to keep the process' fd count low, thereby creating kernel-memory or file-descriptors exhaustion (denial of service).
Stateme
Ubuntu
Linux kernel (Wily HWE) vulnerabilities
vendor_ubuntu·2016-02-22·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel (Wily HWE) vulnerabilities
Title: Linux kernel (Wily HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as POSIX ACLs. A
local unprivileged attacker could use this to gain privileges.
(CVE-2016-1575)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
It was discovered that the Linux kernel's Filesystem in
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-02-22·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as POSIX ACLs. A
local unprivileged attacker could use this to gain privileges.
(CVE-2016-1575)
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
It was discovered that the Linux kernel's Filesystem in Userspace (
Red Hat
kernel: File descriptors passed over unix sockets are not properly accounted
vendor_redhat·2016-01-19·CVSS 6.2
CVE-2013-4312 [MEDIUM] CWE-400 kernel: File descriptors passed over unix sockets are not properly accounted
kernel: File descriptors passed over unix sockets are not properly accounted
The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.
It was found that the Linux kernel did not properly account file descriptors passed over the unix socket against the process limit. A local user could use this flaw to exhaust all available memory on the system.
Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7, and MRG-2. Future Linux kernel updates for the respective releases might address this issue.
This issue affects the Linux kernel packages as shipped with
Debian
CVE-2016-2550: linux - The Linux kernel before 4.5 allows local users to bypass file-descriptor limits ...
vendor_debian·2016·CVSS 6.2
CVE-2016-2550 [MEDIUM] CVE-2016-2550: linux - The Linux kernel before 4.5 allows local users to bypass file-descriptor limits ...
The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.
Scope: local
bookworm: resolved (fixed in 4.4.4-1)
bullseye: resolved (fixed in 4.4.4-1)
forky: resolved (fixed in 4.4.4-1)
sid: resolved (fixed in 4.4.4-1)
trixie: resolved (fixed in 4.4.4-1)
Debian
CVE-2013-4312: linux - The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limit...
vendor_debian·2013·CVSS 6.2
CVE-2013-4312 [MEDIUM] CVE-2013-4312: linux - The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limit...
The Linux kernel before 4.4.1 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by sending each descriptor over a UNIX socket before closing it, related to net/unix/af_unix.c and net/unix/garbage.c.
Scope: local
bookworm: resolved (fixed in 4.3.3-6)
bullseye: resolved (fixed in 4.3.3-6)
forky: resolved (fixed in 4.3.3-6)
sid: resolved (fixed in 4.3.3-6)
trixie: resolved (fixed in 4.3.3-6)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-2847 kernel: pipe: limit the per-user amount of pages allocated in pipes [fedora-all]
bugzilla·2016-03-01·CVSS 6.2
CVE-2016-2847 [MEDIUM] CVE-2016-2847 kernel: pipe: limit the per-user amount of pages allocated in pipes [fedora-all]
CVE-2016-2847 kernel: pipe: limit the per-user amount of pages allocated in pipes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppo
Bugzilla
CVE-2016-2550 kernel: incorrectly accounted in-flight fds
bugzilla·2016-02-24·CVSS 6.2
CVE-2016-2550 [MEDIUM] CVE-2016-2550 kernel: incorrectly accounted in-flight fds
CVE-2016-2550 kernel: incorrectly accounted in-flight fds
The fix for CVE-2013-4312 incorrectly accounted the
number of in-flight fds over a unix domain socket to the original
opener of the file-descriptor. This allows another process to
arbitrary deplete the original file-openers resource limit for the
maximum of open files.
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/401
http://seclists.org/oss-sec/2016/q1/412
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=415e3d3e90ce9e18727e8843ae343eda5a58fad6
Commit, which introduced the issue (it was addressing CVE-2013-4312):
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=712f4aad406bb1ed67f3f98d04c044191f0ff593
Discussion:
Created kernel trackin
Bugzilla
CVE-2013-4312 kernel: File descriptors passed over unix sockets are not properly accounted [fedora-all]
bugzilla·2016-01-20·CVSS 6.2
CVE-2013-4312 [MEDIUM] CVE-2013-4312 kernel: File descriptors passed over unix sockets are not properly accounted [fedora-all]
CVE-2013-4312 kernel: File descriptors passed over unix sockets are not properly accounted [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multi
Bugzilla
CVE-2013-4312 kernel: File descriptors passed over unix sockets are not properly accounted
bugzilla·2016-01-12·CVSS 6.2
CVE-2013-4312 [MEDIUM] CVE-2013-4312 kernel: File descriptors passed over unix sockets are not properly accounted
CVE-2013-4312 kernel: File descriptors passed over unix sockets are not properly accounted
It was found that process could allocate and accumulate far more FDs than the process' limit by sending them over a unix socket then closing them to keep the process' fd count low, which could result into a local DoS against kernel by depleting all available memory.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=712f4aad406b
Discussion:
https://lkml.org/lkml/2015/12/28/155
Discussion:
This issue went public via debian security advisory:
https://www.debian.org/security/2016/dsa-3448
---
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1300216]
---
Statement:
This issue affects the Linux kernel packages as shipped with Red Hat En
arXiv
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
arxiv_fulltext·2025-11-21
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
Characteristics, Root Causes, and Detection of
Incomplete Security Bug Fixes in the Linux Kernel
Qiang Liu^1All work was done by Aug., 2022.,
Wenlong Zhang^1,
Muhui Jiang^2,1,
Lei Wu^1,
Yajin Zhou^1
^1Zhejiang University,
^2The Hong Kong Polytechnic University
## Abstract
Security bugs in the Linux kernel emerge endlessly and have attracted much
attention.
However, fixing security bugs in the Linux kernel could be incomplete due to
human mistakes.
Specifically, an incomplete fix fails to repair all the original security
defects in the software, fails to properly repair the original security defects,
or introduces new ones.
In this paper, we study the fixes of incomplete security bugs in the Linux
kernel for the first time, and reveal their characteristics, root causes as well
as de
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=712f4aad406bb1ed67f3f98d04c044191f0ff593http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176464.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0855.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2574.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2584.htmlhttp://www.debian.org/security/2016/dsa-3448http://www.debian.org/security/2016/dsa-3503http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/82986http://www.ubuntu.com/usn/USN-2929-1http://www.ubuntu.com/usn/USN-2929-2http://www.ubuntu.com/usn/USN-2931-1http://www.ubuntu.com/usn/USN-2932-1http://www.ubuntu.com/usn/USN-2967-1http://www.ubuntu.com/usn/USN-2967-2https://bugzilla.redhat.com/show_bug.cgi?id=1297813https://github.com/torvalds/linux/commit/712f4aad406bb1ed67f3f98d04c044191f0ff593https://security-tracker.debian.org/tracker/CVE-2013-4312http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=712f4aad406bb1ed67f3f98d04c044191f0ff593http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176464.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0855.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2574.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2584.htmlhttp://www.debian.org/security/2016/dsa-3448http://www.debian.org/security/2016/dsa-3503http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/82986http://www.ubuntu.com/usn/USN-2929-1http://www.ubuntu.com/usn/USN-2929-2http://www.ubuntu.com/usn/USN-2931-1http://www.ubuntu.com/usn/USN-2932-1http://www.ubuntu.com/usn/USN-2967-1http://www.ubuntu.com/usn/USN-2967-2https://bugzilla.redhat.com/show_bug.cgi?id=1297813https://github.com/torvalds/linux/commit/712f4aad406bb1ed67f3f98d04c044191f0ff593https://security-tracker.debian.org/tracker/CVE-2013-4312
2016-02-08
Published