CVE-2016-10088
published 2016-12-30CVE-2016-10088: The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows…
PriorityP433high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.37%
30.0th percentile
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.8.15-2 (bookworm) | linux 4.8.15-2 (bookworm) |
| linux | linux_kernel | < 3.10.107 | 3.10.107 |
| linux | linux_kernel | >= 0 < 4.8.15-2 | 4.8.15-2 |
| linux | linux_kernel | >= 0 < 4.8.15-2 | 4.8.15-2 |
| linux | linux_kernel | >= 0 < 4.8.15-2 | 4.8.15-2 |
| linux | linux_kernel | >= 0 < 4.8.15-2 | 4.8.15-2 |
| linux | linux_kernel | >= 0 < 3.13.0-125.174 | 3.13.0-125.174 |
| linux | linux_kernel | >= 0 < 4.4.0-64.85 | 4.4.0-64.85 |
| linux | linux_kernel | >= 3.11 < 3.12.70 | 3.12.70 |
| linux | linux_kernel | >= 3.13 < 3.16.40 | 3.16.40 |
| linux | linux_kernel | >= 3.17 < 3.18.47 | 3.18.47 |
| linux | linux_kernel | >= 3.19 < 4.1.38 | 4.1.38 |
| linux | linux_kernel | >= 4.2 < 4.4.41 | 4.4.41 |
| linux | linux_kernel | >= 4.5 < 4.8.17 | 4.8.17 |
| linux | linux_kernel | >= 4.9 < 4.9.2 | 4.9.2 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
vendor_ubuntu7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-07-21·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
It was discovered that a use-after-free vulnerability existed in the
performance events and counters subsystem of the Linux kernel for ARM64. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2015-8955)
It was discovered that the SCSI generic (sg) driver in the
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2017-07-21·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3360-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 ESM.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
It was discovered that a use-after-free vulnerability existed in the
performance events and counters s
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2017-02-22·CVSS 7.0
CVE-2016-10088 [HIGH] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-3208-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that the generic SCSI block layer in the Linux kernel did
not properly restrict write operations in certain situations. A local
attacker could use this to cause a denial of service (system crash) or
possibly gain administrative privileges. (CVE-2016-10088)
CAI Qian discovered that the sysctl implementation in the Linux kernel did
not properly perform reference counting in some situations. An unprivileged
attacker could use this to cause a denial of serv
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-02-22·CVSS 7.0
CVE-2016-10088 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the generic SCSI block layer in the Linux kernel did
not properly restrict write operations in certain situations. A local
attacker could use this to cause a denial of service (system crash) or
possibly gain administrative privileges. (CVE-2016-10088)
CAI Qian discovered that the sysctl implementation in the Linux kernel did
not properly perform reference counting in some situations. An unprivileged
attacker could use this to cause a denial of service (system hang).
(CVE-2016-9191)
Jim Mattson discovered that the KVM implementation in the Linux kernel
mismanages the #BP and #OF exceptions. A local attacker in a guest virtual
machine could use this to cause a denial of s
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-02-22·CVSS 7.0
CVE-2016-10088 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the generic SCSI block layer in the Linux kernel did
not properly restrict write operations in certain situations. A local
attacker could use this to cause a denial of service (system crash) or
possibly gain administrative privileges. (CVE-2016-10088)
Jim Mattson discovered that the KVM implementation in the Linux kernel
mismanages the #BP and #OF exceptions. A local attacker in a guest virtual
machine could use this to cause a denial of service (guest OS crash).
(CVE-2016-9588)
Andrey Konovalov discovered a use-after-free vulnerability in the DCCP
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service (system crash) or possibly
Red Hat
kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
vendor_redhat·2017-01-11·CVSS 7.0
CVE-2016-10088 [HIGH] CWE-416 kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
It was found that the fix for CVE-2016-9576 was incomplete: the Linux kernel's sg implementation did not properly restrict write operations in situations where the KERNEL_DS option is set. A local attacker to read or write to arbitrary kernel memory locations or cause a deni
Debian
CVE-2016-10088: linux - The sg implementation in the Linux kernel through 4.9 does not properly restrict...
vendor_debian·2016·CVSS 7.0
CVE-2016-10088 [HIGH] CVE-2016-10088: linux - The sg implementation in the Linux kernel through 4.9 does not properly restrict...
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
Scope: local
bookworm: resolved (fixed in 4.8.15-2)
bullseye: resolved (fixed in 4.8.15-2)
forky: resolved (fixed in 4.8.15-2)
sid: resolved (fixed in 4.8.15-2)
trixie: resolved (fixed in 4.8.15-2)
GHSA
GHSA-m9p4-r7pw-hpw3: The sg implementation in the Linux kernel through 4
ghsa_unreviewed·2022-05-14·CVSS 7.8
CVE-2016-10088 [HIGH] CWE-416 GHSA-m9p4-r7pw-hpw3: The sg implementation in the Linux kernel through 4
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
OSV
linux vulnerabilities
osv·2017-07-21·CVSS 5.5
CVE-2014-9900 [MEDIUM] linux vulnerabilities
linux vulnerabilities
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
It was discovered that a use-after-free vulnerability existed in the
performance events and counters subsystem of the Linux kernel for ARM64. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2015-8955)
It was discovered that the SCSI generic (sg) driver in the Linux kernel
contained a double-free vulnerability. A local attacker could use
OSV
linux, linux-snapdragon vulnerabilities
osv·2017-02-22·CVSS 7.0
CVE-2016-10088 [HIGH] linux, linux-snapdragon vulnerabilities
linux, linux-snapdragon vulnerabilities
It was discovered that the generic SCSI block layer in the Linux kernel did
not properly restrict write operations in certain situations. A local
attacker could use this to cause a denial of service (system crash) or
possibly gain administrative privileges. (CVE-2016-10088)
CAI Qian discovered that the sysctl implementation in the Linux kernel did
not properly perform reference counting in some situations. An unprivileged
attacker could use this to cause a denial of service (system hang).
(CVE-2016-9191)
Jim Mattson discovered that the KVM implementation in the Linux kernel
mismanages the #BP and #OF exceptions. A local attacker in a guest virtual
machine could use this to cause a denial of service (guest OS crash).
(CVE-2016-9588)
Andy Lutomirsk
OSV
linux-lts-xenial vulnerabilities
osv·2017-02-22·CVSS 7.0
[HIGH] linux-lts-xenial vulnerabilities
linux-lts-xenial vulnerabilities
USN-3208-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that the generic SCSI block layer in the Linux kernel did
not properly restrict write operations in certain situations. A local
attacker could use this to cause a denial of service (system crash) or
possibly gain administrative privileges. (CVE-2016-10088)
CAI Qian discovered that the sysctl implementation in the Linux kernel did
not properly perform reference counting in some situations. An unprivileged
attacker could use this to cause a denial of service (system hang).
(CVE-2016-9191)
Jim Mattson discovered that the KVM impl
OSV
CVE-2016-10088: The sg implementation in the Linux kernel through 4
osv·2016-12-30·CVSS 7.0
CVE-2016-10088 [HIGH] CVE-2016-10088: The sg implementation in the Linux kernel through 4
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-10088 kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
bugzilla·2017-01-11·CVSS 7.0
CVE-2016-10088 [HIGH] CVE-2016-10088 kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
CVE-2016-10088 kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
References:
http://seclists.org/oss-sec/2016/q4/779
Upstream patch:
https://git.kernel.org/linus/128394eff343fc6d2f32172f03e24829539c5835
This is an additional fix for CVE-2016-9576, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1403145
Discussion:
S
Bugzilla
CVE-2016-9576 kernel: Use after free in SCSI generic device interface
bugzilla·2016-12-09·CVSS 7.0
CVE-2016-9576 [HIGH] CVE-2016-9576 kernel: Use after free in SCSI generic device interface
CVE-2016-9576 kernel: Use after free in SCSI generic device interface
Use-after-free vulnerability in SCSI generic device interface has been reported which allows kernel memory read/write when having access to /dev/sg* SCSI generic devices. This issue affects versions of Linux down to 2.6. This was assigned CVE-2016-9576.
Initial message:
https://www.spinics.net/lists/linux-scsi/msg102232.html
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ac402cfcdc904f9772e1762b3fda112dcc56a0
Oss-security post:
http://seclists.org/oss-sec/2016/q4/644
Later an additional fix was developed, it was assigned CVE-2016-10088, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1412210
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora
Bugzilla
CVE-2016-9576 CVE-2016-10088 kernel: Use after free in SCSI generic device interface [fedora-all]
bugzilla·2016-12-09·CVSS 7.0
CVE-2016-9576 [HIGH] CVE-2016-9576 CVE-2016-10088 kernel: Use after free in SCSI generic device interface [fedora-all]
CVE-2016-9576 CVE-2016-10088 kernel: Use after free in SCSI generic device interface [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple su
arXiv
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
arxiv_fulltext·2025-11-21
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
Characteristics, Root Causes, and Detection of
Incomplete Security Bug Fixes in the Linux Kernel
Qiang Liu^1All work was done by Aug., 2022.,
Wenlong Zhang^1,
Muhui Jiang^2,1,
Lei Wu^1,
Yajin Zhou^1
^1Zhejiang University,
^2The Hong Kong Polytechnic University
## Abstract
Security bugs in the Linux kernel emerge endlessly and have attracted much
attention.
However, fixing security bugs in the Linux kernel could be incomplete due to
human mistakes.
Specifically, an incomplete fix fails to repair all the original security
defects in the software, fails to properly repair the original security defects,
or introduces new ones.
In this paper, we study the fixes of incomplete security bugs in the Linux
kernel for the first time, and reveal their characteristics, root causes as well
as de
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=128394eff343fc6d2f32172f03e24829539c5835http://rhn.redhat.com/errata/RHSA-2017-0817.htmlhttp://www.openwall.com/lists/oss-security/2016/12/30/1http://www.securityfocus.com/bid/95169http://www.securitytracker.com/id/1037538https://access.redhat.com/errata/RHSA-2017:1842https://access.redhat.com/errata/RHSA-2017:2077https://access.redhat.com/errata/RHSA-2017:2669https://github.com/torvalds/linux/commit/128394eff343fc6d2f32172f03e24829539c5835http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=128394eff343fc6d2f32172f03e24829539c5835http://rhn.redhat.com/errata/RHSA-2017-0817.htmlhttp://www.openwall.com/lists/oss-security/2016/12/30/1http://www.securityfocus.com/bid/95169http://www.securitytracker.com/id/1037538https://access.redhat.com/errata/RHSA-2017:1842https://access.redhat.com/errata/RHSA-2017:2077https://access.redhat.com/errata/RHSA-2017:2669https://github.com/torvalds/linux/commit/128394eff343fc6d2f32172f03e24829539c5835
2016-12-30
Published