CVE-2016-0774
published 2016-04-27CVE-2016-0774: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian…
PriorityP426medium6.8CVSS 3.0
AVLACLPRNUINSUCLINAH
EPSS
0.34%
26.4th percentile
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.16.2-2 (bookworm) | linux 3.16.2-2 (bookworm) |
| android | <= 6.0.1 | — | |
| android | — | — | |
| linux | linux_kernel | >= 0 < 3.16.2-2 | 3.16.2-2 |
| linux | linux_kernel | >= 0 < 3.16.2-2 | 3.16.2-2 |
| linux | linux_kernel | >= 0 < 3.16.2-2 | 3.16.2-2 |
| linux | linux_kernel | >= 0 < 3.16.2-2 | 3.16.2-2 |
| linux | linux_kernel | >= 0 < 3.13.0-86.130 | 3.13.0-86.130 |
CVSS provenance
nvdv3.06.8MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
nvdv2.05.6MEDIUMAV:L/AC:L/Au:N/C:P/I:N/A:C
osv7.2HIGH
vendor_debian7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qc32-8fv3-qwvw: The (1) pipe_read and (2) pipe_write implementations in fs/pipe
ghsa_unreviewed·2022-05-17·CVSS 7.2
CVE-2016-0774 [HIGH] CWE-20 GHSA-qc32-8fv3-qwvw: The (1) pipe_read and (2) pipe_write implementations in fs/pipe
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.
OSV
linux vulnerabilities
osv·2016-05-09·CVSS 7.2
CVE-2015-7515 [HIGH] linux vulnerabilities
linux vulnerabilities
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7515)
Ben Hawkes discovered that the Linux kernel's AIO interface allowed single
writes greater than 2GB, which could cause an integer overflow when writing
to certain filesystems, socket or device types. A local attacker could this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2015-8830)
It was discovered that the Linux kernel did not keep accurate track of pipe
buffer details when error conditions occurred, due to an incomplete fix for
CVE-2015-1805. A local attacker could use this to c
OSV
CVE-2016-0774: The (1) pipe_read and (2) pipe_write implementations in fs/pipe
osv·2016-04-27·CVSS 7.2
CVE-2016-0774 [HIGH] CVE-2016-0774: The (1) pipe_read and (2) pipe_write implementations in fs/pipe
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-05-09·CVSS 7.2
CVE-2015-7515 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7515)
Ben Hawkes discovered that the Linux kernel's AIO interface allowed single
writes greater than 2GB, which could cause an integer overflow when writing
to certain filesystems, socket or device types. A local attacker could this
to cause a denial of service (system crash) or possibly execute arbitrary
code. (CVE-2015-8830)
It was discovered that the Linux kernel did not keep accurate track of pipe
buffer details when error conditions occurred, due to
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-05-09·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7515)
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7566)
Ral
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2016-05-09·CVSS 7.2
CVE-2015-7515 [HIGH] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-2968-1 fixed vulnerabilities in the Linux kernel for Ubuntu
14.04 LTS. This update provides the corresponding updates for the
Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for
Ubuntu 12.04 LTS.
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7515)
Ben Hawkes discovered that the Linux kernel's AIO interface allowed single
writes greater than 2GB, which could cause an integer overflow when writing
to certain filesystems, socket or device types. A local attacker could this
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2016-05-09·CVSS 6.2
CVE-2013-4312 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the Linux kernel did not properly enforce rlimits
for file descriptors sent over UNIX domain sockets. A local attacker could
use this to cause a denial of service. (CVE-2013-4312)
Ralf Spenneberg discovered that the Aiptek Tablet USB device driver in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7515)
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-75
Android
CVE-2016-0774: Android Security Bulletin 2016-05-01
CVE: CVE-2016-0774
Severity: LOW
vendor_android·2016-05-01·CVSS 6.8
CVE-2016-0774 [MEDIUM] CVE-2016-0774: Android Security Bulletin 2016-05-01
CVE: CVE-2016-0774
Severity: LOW
Android Security Bulletin 2016-05-01
CVE: CVE-2016-0774
Severity: LOW
Red Hat
kernel: pipe buffer state corruption after unsuccessful atomic read from pipe
vendor_redhat·2016-02-02·CVSS 7.2
CVE-2016-0774 [HIGH] kernel: pipe buffer state corruption after unsuccessful atomic read from pipe
kernel: pipe buffer state corruption after unsuccessful atomic read from pipe
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.
It was found that the fix for CVE-2015-1805 incorrectly kept buffer offset and buffer length in sync on a failed atomic re
Debian
CVE-2016-0774: linux - The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain L...
vendor_debian·2016·CVSS 7.2
CVE-2016-0774 [HIGH] CVE-2016-0774: linux - The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain L...
The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.
Scope: local
bookworm: resolved (fixed in 3.16.2-2)
bullseye: resolved (fixed in 3.16.2-2)
forky: resolved (fixed in 3.16.2-2)
sid: resolved (fixed in 3.16.2-2)
trixie: resolved (fixed in 3.16.2-2)
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00028.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00030.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00033.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00034.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00036.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00037.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0494.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0617.htmlhttp://source.android.com/security/bulletin/2016-05-01.htmlhttp://www.debian.org/security/2016/dsa-3503http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/84126http://www.ubuntu.com/usn/USN-2967-1http://www.ubuntu.com/usn/USN-2967-2http://www.ubuntu.com/usn/USN-2968-1http://www.ubuntu.com/usn/USN-2968-2https://bugzilla.redhat.com/show_bug.cgi?id=1303961https://security-tracker.debian.org/tracker/CVE-2016-0774http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00028.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00029.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00030.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00033.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00034.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00036.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00037.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0494.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0617.htmlhttp://source.android.com/security/bulletin/2016-05-01.htmlhttp://www.debian.org/security/2016/dsa-3503http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.htmlhttp://www.securityfocus.com/bid/84126http://www.ubuntu.com/usn/USN-2967-1http://www.ubuntu.com/usn/USN-2967-2http://www.ubuntu.com/usn/USN-2968-1http://www.ubuntu.com/usn/USN-2968-2https://bugzilla.redhat.com/show_bug.cgi?id=1303961https://security-tracker.debian.org/tracker/CVE-2016-0774
2016-04-27
Published