CVE-2016-2085
published 2016-04-27CVE-2016-2085: The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local…
PriorityP422medium5.5CVSS 3.0
AVLACLPRLUINSUCNIHAN
EPSS
0.44%
36.3th percentile
The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.4.2-1 (bookworm) | linux 4.4.2-1 (bookworm) |
| linux | linux_kernel | <= 4.4.8 | — |
| linux | linux_kernel | >= 0 < 4.4.2-1 | 4.4.2-1 |
| linux | linux_kernel | >= 0 < 4.4.2-1 | 4.4.2-1 |
| linux | linux_kernel | >= 0 < 4.4.2-1 | 4.4.2-1 |
| linux | linux_kernel | >= 0 < 4.4.2-1 | 4.4.2-1 |
| linux | linux_kernel | >= 0 < 3.13.0-85.129 | 3.13.0-85.129 |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Utopic HWE) regression
vendor_ubuntu·2016-04-11·CVSS 4.6
[MEDIUM] Linux kernel (Utopic HWE) regression
Title: Linux kernel (Utopic HWE) regression
Summary: USN 2948-1 introduced a regression in the Ubuntu 14.10 Linux kernel
backported to Ubuntu 14.04 LTS.
USN-2948-1 fixed vulnerabilities in the Ubuntu 14.10 Linux kernel
backported to Ubuntu 14.04 LTS. An incorrect reference counting
fix in the radeon driver introduced a regression that could cause a
system crash. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7566)
Ralf Spenneberg discovered that the usbvision driver in the Linux kernel
did not properly
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2016-04-06·CVSS 9.8
CVE-2015-8812 [CRITICAL] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
Xiaofei Rex Guo discovered a timing side channel vulnerability in the Linux
Extended Verification Module (EVM). An attacker could use this to affect
system integrity. (CVE-2016-2085)
David Herrmann discovered that the Linux kernel incorrectly accounted file
descriptors to the original opener for in-flight file descriptors sent over
a unix domain socket. A local attacker could use this to cause a denial of
service (resource exhaustion). (CVE-2016-2550)
It was d
Ubuntu
Linux kernel (Wily HWE) vulnerabilities
vendor_ubuntu·2016-04-06·CVSS 4.9
CVE-2015-7833 [MEDIUM] Linux kernel (Wily HWE) vulnerabilities
Title: Linux kernel (Wily HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Ralf Spenneberg discovered that the usbvision driver in the Linux kernel
did not properly validate the interfaces and endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7833)
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
Xiaofei Rex Guo discovered a timing side channel vulnerability in the Linux
Extended Verification Module (EVM). An attacker could use this to affect
system integrity. (CVE-2016-2085)
It was discovered that the extende
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-04-06·CVSS 9.8
CVE-2015-8812 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
Xiaofei Rex Guo discovered a timing side channel vulnerability in the Linux
Extended Verification Module (EVM). An attacker could use this to affect
system integrity. (CVE-2016-2085)
David Herrmann discovered that the Linux kernel incorrectly accounted file
descriptors to the original opener for in-flight file descriptors sent over
a unix domain socket. A local attacker could use this to cause a denial of
service (resource exhaustion). (CVE-2016-2550)
It was discovered tha
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-04-06·CVSS 4.9
CVE-2015-7833 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Ralf Spenneberg discovered that the usbvision driver in the Linux kernel
did not properly validate the interfaces and endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7833)
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
Xiaofei Rex Guo discovered a timing side channel vulnerability in the Linux
Extended Verification Module (EVM). An attacker could use this to affect
system integrity. (CVE-2016-2085)
It was discovered that the extended Berkeley
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2016-04-06·CVSS 4.9
CVE-2015-7833 [MEDIUM] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Ralf Spenneberg discovered that the usbvision driver in the Linux kernel
did not properly validate the interfaces and endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7833)
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
Xiaofei Rex Guo discovered a timing side channel vulnerability in the Linux
Extended Verification Module (EVM). An attacker could use this to affect
system integrity. (CVE-2016-2085)
It was discovered that the e
Ubuntu
Linux kernel (Vivid HWE) vulnerabilities
vendor_ubuntu·2016-04-06·CVSS 9.8
CVE-2015-8812 [CRITICAL] Linux kernel (Vivid HWE) vulnerabilities
Title: Linux kernel (Vivid HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
Xiaofei Rex Guo discovered a timing side channel vulnerability in the Linux
Extended Verification Module (EVM). An attacker could use this to affect
system integrity. (CVE-2016-2085)
David Herrmann discovered that the Linux kernel incorrectly accounted file
descriptors to the original opener for in-flight file descriptors sent over
a unix domain socket. A local attacker could use this to cause a denial of
service (resource exhaustion). (CVE-2016-2550)
It was di
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities
vendor_ubuntu·2016-04-06·CVSS 4.6
CVE-2015-7566 [MEDIUM] Linux kernel (Utopic HWE) vulnerabilities
Title: Linux kernel (Utopic HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7566)
Ralf Spenneberg discovered that the usbvision driver in the Linux kernel
did not properly validate the interfaces and endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7833)
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arb
Red Hat
kernel: timing side channel vulnerability in the Linux Extended Verification Module
vendor_redhat·2016-02-11·CVSS 5.5
CVE-2016-2085 [MEDIUM] CWE-385 kernel: timing side channel vulnerability in the Linux Extended Verification Module
kernel: timing side channel vulnerability in the Linux Extended Verification Module
The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.
Statement: This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 4,5 and 6.
This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7 and kernel-rt packages and does not plan to be addressed in a future update.
Package: kernel (Red Hat Enterprise Linux 4) - Not affected
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) -
Debian
CVE-2016-2085: linux - The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux k...
vendor_debian·2016·CVSS 5.5
CVE-2016-2085 [MEDIUM] CVE-2016-2085: linux - The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux k...
The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.
Scope: local
bookworm: resolved (fixed in 4.4.2-1)
bullseye: resolved (fixed in 4.4.2-1)
forky: resolved (fixed in 4.4.2-1)
sid: resolved (fixed in 4.4.2-1)
trixie: resolved (fixed in 4.4.2-1)
GHSA
GHSA-w99v-p99f-6f3g: The evm_verify_hmac function in security/integrity/evm/evm_main
ghsa_unreviewed·2022-05-17
CVE-2016-2085 [MEDIUM] GHSA-w99v-p99f-6f3g: The evm_verify_hmac function in security/integrity/evm/evm_main
The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.
OSV
CVE-2016-2085: The evm_verify_hmac function in security/integrity/evm/evm_main
osv·2016-04-27·CVSS 5.5
CVE-2016-2085 [MEDIUM] CVE-2016-2085: The evm_verify_hmac function in security/integrity/evm/evm_main
The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.
OSV
linux-lts-utopic regression
osv·2016-04-11·CVSS 4.6
[MEDIUM] linux-lts-utopic regression
linux-lts-utopic regression
USN-2948-1 fixed vulnerabilities in the Ubuntu 14.10 Linux kernel
backported to Ubuntu 14.04 LTS. An incorrect reference counting
fix in the radeon driver introduced a regression that could cause a
system crash. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7566)
Ralf Spenneberg discovered that the usbvision driver in the Linux kernel
did not properly validate the interfaces and endpoints reported by the
device. An attacker with physical access could cause a denial of service
OSV
linux vulnerabilities
osv·2016-04-06·CVSS 9.8
CVE-2015-8812 [CRITICAL] linux vulnerabilities
linux vulnerabilities
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
Xiaofei Rex Guo discovered a timing side channel vulnerability in the Linux
Extended Verification Module (EVM). An attacker could use this to affect
system integrity. (CVE-2016-2085)
David Herrmann discovered that the Linux kernel incorrectly accounted file
descriptors to the original opener for in-flight file descriptors sent over
a unix domain socket. A local attacker could use this to cause a denial of
service (resource exhaustion). (CVE-2016-2550)
It was discovered that the Linux kernel did not enforce limits on the
amount of data allocated
OSV
linux-lts-utopic vulnerabilities
osv·2016-04-06·CVSS 4.6
CVE-2015-7566 [MEDIUM] linux-lts-utopic vulnerabilities
linux-lts-utopic vulnerabilities
Ralf Spenneberg discovered that the USB driver for Clie devices in the
Linux kernel did not properly validate the endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7566)
Ralf Spenneberg discovered that the usbvision driver in the Linux kernel
did not properly validate the interfaces and endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7833)
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
It was discovered that a race condition existe
OSV
linux-lts-wily vulnerabilities
osv·2016-04-06·CVSS 4.9
CVE-2015-7833 [MEDIUM] linux-lts-wily vulnerabilities
linux-lts-wily vulnerabilities
Ralf Spenneberg discovered that the usbvision driver in the Linux kernel
did not properly validate the interfaces and endpoints reported by the
device. An attacker with physical access could cause a denial of service
(system crash). (CVE-2015-7833)
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
Xiaofei Rex Guo discovered a timing side channel vulnerability in the Linux
Extended Verification Module (EVM). An attacker could use this to affect
system integrity. (CVE-2016-2085)
It was discovered that the extended Berkeley Packet Filter (eBPF)
implementation in the Linux kernel did not c
OSV
linux-lts-vivid vulnerabilities
osv·2016-04-06·CVSS 9.8
CVE-2015-8812 [CRITICAL] linux-lts-vivid vulnerabilities
linux-lts-vivid vulnerabilities
Venkatesh Pottem discovered a use-after-free vulnerability in the Linux
kernel's CXGB3 driver. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2015-8812)
Xiaofei Rex Guo discovered a timing side channel vulnerability in the Linux
Extended Verification Module (EVM). An attacker could use this to affect
system integrity. (CVE-2016-2085)
David Herrmann discovered that the Linux kernel incorrectly accounted file
descriptors to the original opener for in-flight file descriptors sent over
a unix domain socket. A local attacker could use this to cause a denial of
service (resource exhaustion). (CVE-2016-2550)
It was discovered that the Linux kernel did not enforce limits on the
amount of data
Kernel
EVM: Use crypto_memneq() for digest comparisons
kernel_security·2016-02-11·CVSS 5.5
CVE-2016-2085 [MEDIUM] EVM: Use crypto_memneq() for digest comparisons
EVM: Use crypto_memneq() for digest comparisons
This patch fixes vulnerability CVE-2016-2085. The problem exists
because the vm_verify_hmac() function includes a use of memcmp().
Unfortunately, this allows timing side channel attacks; specifically
a MAC forgery complexity drop from 2^128 to 2^12. This patch changes
the memcmp() to the cryptographically safe crypto_memneq().
Reported-by: Xiaofei Rex Guo
Signed-off-by: Ryan Ware
Cc: [email protected]
Signed-off-by: Mimi Zohar
Signed-off-by: James Morris
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-7433 ntp: Broken initial sync calculations regression
bugzilla·2016-11-22·CVSS 5.3
CVE-2016-7433 [MEDIUM] CVE-2016-7433 ntp: Broken initial sync calculations regression
CVE-2016-7433 ntp: Broken initial sync calculations regression
Bug 2085 described a condition where the root delay was included twice, causing the jitter value to be higher than expected. Due to a misinterpretation of a small-print variable in The Book, the fix for this problem was incorrect, resulting in a root distance that did not include the peer dispersion. The calculations and formulae have been reviewed and reconciled, and the code has been updated accordingly.
External References:
http://support.ntp.org/bin/view/Main/NtpBug3067
Discussion:
Created ntp tracking bugs for this issue:
Affects: fedora-all [bug 1397351]
---
Analysis:
When an offpath attacker can spoof the first ntp reply, ntpd will jump and when it gets a real response, it will exit.
---
Is an RPM released wit
Bugzilla
CVE-2016-2085 kernel: timing side channel vulnerability in the Linux Extended Verification Module
bugzilla·2016-04-07·CVSS 5.5
CVE-2016-2085 [MEDIUM] CVE-2016-2085 kernel: timing side channel vulnerability in the Linux Extended Verification Module
CVE-2016-2085 kernel: timing side channel vulnerability in the Linux Extended Verification Module
A timing side channel vulnerability was discovered in the Linux Extended Verification Module (EVM). An attacker could use this to affect system integrity.
The problem exists because the vm_verify_hmac() function includes a use of memcmp(). This function is not safe to be used for comparing memory, allows timing side channel attacks; specifically a MAC forgery complexity drop from 2^128 to 2^12. This patch changes the memcmp() to the cryptographically safe crypto_memneq().
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=613317bd212c585c20796c10afe5daaa95d4b0a1
Original bug report:
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2085
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=613317bd212c585c20796c10afe5daaa95d4b0a1http://www.ubuntu.com/usn/USN-2946-1http://www.ubuntu.com/usn/USN-2946-2http://www.ubuntu.com/usn/USN-2947-1http://www.ubuntu.com/usn/USN-2947-2http://www.ubuntu.com/usn/USN-2947-3http://www.ubuntu.com/usn/USN-2948-1http://www.ubuntu.com/usn/USN-2948-2http://www.ubuntu.com/usn/USN-2949-1https://bugzilla.redhat.com/show_bug.cgi?id=1324867https://github.com/torvalds/linux/commit/613317bd212c585c20796c10afe5daaa95d4b0a1https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2085.htmlhttps://security-tracker.debian.org/tracker/CVE-2016-2085http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=613317bd212c585c20796c10afe5daaa95d4b0a1http://www.ubuntu.com/usn/USN-2946-1http://www.ubuntu.com/usn/USN-2946-2http://www.ubuntu.com/usn/USN-2947-1http://www.ubuntu.com/usn/USN-2947-2http://www.ubuntu.com/usn/USN-2947-3http://www.ubuntu.com/usn/USN-2948-1http://www.ubuntu.com/usn/USN-2948-2http://www.ubuntu.com/usn/USN-2949-1https://bugzilla.redhat.com/show_bug.cgi?id=1324867https://github.com/torvalds/linux/commit/613317bd212c585c20796c10afe5daaa95d4b0a1https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2085.htmlhttps://security-tracker.debian.org/tracker/CVE-2016-2085
2016-04-27
Published