CVE-2016-10044
published 2017-02-07CVE-2016-10044: The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.30%
22.3th percentile
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 4.7.8-1 (bookworm) | linux 4.7.8-1 (bookworm) |
| debian | linux | < linux 6.1.123-1 (bookworm) | linux 6.1.123-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.123-1 (bookworm) | linux 6.1.123-1 (bookworm) |
| android | <= 7.1.1 | — | |
| android | — | — | |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3.16.59 < 3.17 | 3.17 |
| linux | linux | >= c8d78c1823f46519473949d33f0d1d33fe21ea16 < 0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1 | 0f910dbf2f2a4a7820ba4bac7b280f7108aa05b1 |
| linux | linux | >= c8d78c1823f46519473949d33f0d1d33fe21ea16 < 49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178 | 49d3a4ad57c57227c3b0fd6cd4188b2a5ebd6178 |
| linux | linux | >= c8d78c1823f46519473949d33f0d1d33fe21ea16 < 3393fddbfa947c8e1fdcc4509226905ffffd8b89 | 3393fddbfa947c8e1fdcc4509226905ffffd8b89 |
| linux | linux | >= c8d78c1823f46519473949d33f0d1d33fe21ea16 < ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3 | ce14f38d6ee9e88e37ec28427b4b93a7c33c70d3 |
| linux | linux | >= c8d78c1823f46519473949d33f0d1d33fe21ea16 < ea7e2d5e49c05e5db1922387b09ca74aa40f46e2 | ea7e2d5e49c05e5db1922387b09ca74aa40f46e2 |
| linux | linux_kernel | < 3.16.43 | 3.16.43 |
| linux | linux_kernel | < 6.1.120 | 6.1.120 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 6.1.123-1 | 6.1.123-1 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 6.11.2-1 | 6.11.2-1 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 6.11.2-1 | 6.11.2-1 |
| linux | linux_kernel | >= 0 < 3.13.0-132.181 | 3.13.0-132.181 |
| linux | linux_kernel | >= 3.17 < 4.4.24 | 4.4.24 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages()
vendor_redhat·2024-10-21·CVSS 7.8
CVE-2024-47745 [HIGH] CWE-670 kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages()
kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages()
In the Linux kernel, the following vulnerability has been resolved:
mm: call the security_mmap_file() LSM hook in remap_file_pages()
The remap_file_pages syscall handler calls do_mmap() directly, which
doesn't contain the LSM security check. And if the process has called
personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for
RW pages, this will actually result in remapping the pages to RWX,
bypassing a W^X policy enforced by SELinux.
So we should check prot by security_mmap_file LSM hook in the
remap_file_pages syscall handler before do_mmap() is called. Otherwise, it
potentially permits an attacker to bypass a W^X policy enforced by
SELinux.
The bypass is similar to CVE-2016-10044, which bypass t
Debian
CVE-2024-47745: linux - In the Linux kernel, the following vulnerability has been resolved: mm: call th...
vendor_debian·2024·CVSS 7.8
CVE-2024-47745 [HIGH] CVE-2024-47745: linux - In the Linux kernel, the following vulnerability has been resolved: mm: call th...
In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux. So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux. The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1]. The PoC: $ cat > test.c int
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-09-18·CVSS 7.8
CVE-2016-10044 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a buffer overflow existed in the Bluetooth stack of
the Linux kernel when handling L2CAP configuration responses. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2017-1000251)
It was discovered that the asynchronous I/O (aio) subsystem of the Linux
kernel did not properly set permissions on aio memory mappings in some
situations. An attacker could use this to more easily exploit other
vulnerabilities. (CVE-2016-10044)
Baozeng Ding and Andrey Konovalov discovered a race condition in the L2TPv3
IP Encapsulation implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system cra
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2017-09-18·CVSS 7.8
CVE-2016-10044 [HIGH] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3422-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 LTS.
It was discovered that a buffer overflow existed in the Bluetooth stack of
the Linux kernel when handling L2CAP configuration responses. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2017-1000251)
It was discovered that the asynchronous I/O (aio) subsystem of the Linux
kernel did not properly set permissions on aio memory mappings in some
situations. An attacker could use this to more easily exploit other
vulnerabi
Android
CVE-2016-10044: Android Security Bulletin 2017-02-01
CVE: CVE-2016-10044
Severity: MEDIUM
References: A-31711619*
vendor_android·2017-02-01·CVSS 7.8
CVE-2016-10044 [HIGH] CVE-2016-10044: Android Security Bulletin 2017-02-01
CVE: CVE-2016-10044
Severity: MEDIUM
References: A-31711619*
Android Security Bulletin 2017-02-01
CVE: CVE-2016-10044
Severity: MEDIUM
References: A-31711619*
Red Hat
kernel: aio_mount function does not properly restrict execute access
vendor_redhat·2016-09-16·CVSS 7.8
CVE-2016-10044 [HIGH] CWE-266 kernel: aio_mount function does not properly restrict execute access
kernel: aio_mount function does not properly restrict execute access
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.
The aio_mount function in fs/aio.c in the Linux kernel does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Affected
Package: realtime-kernel (Red Hat Ent
Debian
CVE-2016-10044: linux - The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not pro...
vendor_debian·2016·CVSS 7.8
CVE-2016-10044 [HIGH] CVE-2016-10044: linux - The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not pro...
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.
Scope: local
bookworm: resolved (fixed in 4.7.8-1)
bullseye: resolved (fixed in 4.7.8-1)
forky: resolved (fixed in 4.7.8-1)
sid: resolved (fixed in 4.7.8-1)
trixie: resolved (fixed in 4.7.8-1)
GHSA
GHSA-qpxg-4f92-ww23: In the Linux kernel, the following vulnerability has been resolved:
mm: call the security_mmap_file() LSM hook in remap_file_pages()
The remap_file_
ghsa_unreviewed·2024-10-21·CVSS 7.8
CVE-2024-47745 [HIGH] CWE-670 GHSA-qpxg-4f92-ww23: In the Linux kernel, the following vulnerability has been resolved:
mm: call the security_mmap_file() LSM hook in remap_file_pages()
The remap_file_
In the Linux kernel, the following vulnerability has been resolved:
mm: call the security_mmap_file() LSM hook in remap_file_pages()
The remap_file_pages syscall handler calls do_mmap() directly, which
doesn't contain the LSM security check. And if the process has called
personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for
RW pages, this will actually result in remapping the pages to RWX,
bypassing a W^X policy enforced by SELinux.
So we should check prot by security_mmap_file LSM hook in the
remap_file_pages syscall handler before do_mmap() is called. Otherwise, it
potentially permits an attacker to bypass a W^X policy enforced by
SELinux.
The bypass is similar to CVE-2016-10044, which bypass the same thing via
AIO and can be found in [1].
The PoC:
$ cat > test
OSV
CVE-2024-47745: In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pa
osv·2024-10-21·CVSS 7.8
CVE-2024-47745 [HIGH] CVE-2024-47745: In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pa
In the Linux kernel, the following vulnerability has been resolved: mm: call the security_mmap_file() LSM hook in remap_file_pages() The remap_file_pages syscall handler calls do_mmap() directly, which doesn't contain the LSM security check. And if the process has called personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for RW pages, this will actually result in remapping the pages to RWX, bypassing a W^X policy enforced by SELinux. So we should check prot by security_mmap_file LSM hook in the remap_file_pages syscall handler before do_mmap() is called. Otherwise, it potentially permits an attacker to bypass a W^X policy enforced by SELinux. The bypass is similar to CVE-2016-10044, which bypass the same thing via AIO and can be found in [1]. The PoC: $ cat > test.c int
Kernel
mm: call the security_mmap_file() LSM hook in remap_file_pages()
kernel_security·2024-09-17·CVSS 7.8
CVE-2016-10044 [HIGH] mm: call the security_mmap_file() LSM hook in remap_file_pages()
mm: call the security_mmap_file() LSM hook in remap_file_pages()
The remap_file_pages syscall handler calls do_mmap() directly, which
doesn't contain the LSM security check. And if the process has called
personality(READ_IMPLIES_EXEC) before and remap_file_pages() is called for
RW pages, this will actually result in remapping the pages to RWX,
bypassing a W^X policy enforced by SELinux.
So we should check prot by security_mmap_file LSM hook in the
remap_file_pages syscall handler before do_mmap() is called. Otherwise, it
potentially permits an attacker to bypass a W^X policy enforced by
SELinux.
The bypass is similar to CVE-2016-10044, which bypass the same thing via
AIO and can be found in [1].
The PoC:
$ cat > test.c
int main(void) {
size_t pagesz = sysconf(_SC_PAGE_SIZE);
int mfd
GHSA
GHSA-mm9p-48xr-prf2: The aio_mount function in fs/aio
ghsa_unreviewed·2022-05-17
CVE-2016-10044 [HIGH] GHSA-mm9p-48xr-prf2: The aio_mount function in fs/aio
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.
OSV
linux vulnerabilities
osv·2017-09-18·CVSS 7.8
CVE-2017-1000251 [HIGH] linux vulnerabilities
linux vulnerabilities
It was discovered that a buffer overflow existed in the Bluetooth stack of
the Linux kernel when handling L2CAP configuration responses. A physically
proximate attacker could use this to cause a denial of service (system
crash). (CVE-2017-1000251)
It was discovered that the asynchronous I/O (aio) subsystem of the Linux
kernel did not properly set permissions on aio memory mappings in some
situations. An attacker could use this to more easily exploit other
vulnerabilities. (CVE-2016-10044)
Baozeng Ding and Andrey Konovalov discovered a race condition in the L2TPv3
IP Encapsulation implementation in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2016-10200)
Andreas Gruenbacher an
OSV
CVE-2016-10044: The aio_mount function in fs/aio
osv·2017-02-07·CVSS 7.8
CVE-2016-10044 [HIGH] CVE-2016-10044: The aio_mount function in fs/aio
The aio_mount function in fs/aio.c in the Linux kernel before 4.7.7 does not properly restrict execute access, which makes it easier for local users to bypass intended SELinux W^X policy restrictions, and consequently gain privileges, via an io_setup system call.
No detection rules found.
No public exploits indexed.
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=22f6b4d34fcf039c63a94e7670e0da24f8575a5ahttp://source.android.com/security/bulletin/2017-02-01.htmlhttp://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.7http://www.securityfocus.com/bid/96122http://www.securitytracker.com/id/1037798https://github.com/torvalds/linux/commit/22f6b4d34fcf039c63a94e7670e0da24f8575a5ahttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=22f6b4d34fcf039c63a94e7670e0da24f8575a5ahttp://source.android.com/security/bulletin/2017-02-01.htmlhttp://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.7.7http://www.securityfocus.com/bid/96122http://www.securitytracker.com/id/1037798https://github.com/torvalds/linux/commit/22f6b4d34fcf039c63a94e7670e0da24f8575a5a
2017-02-07
Published