CVE-2016-4485

CWE-200 — Information Exposure20 documents8 sources
Severity
7.5HIGH
EPSS
0.5%
top 33.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Linux Linux KernelCanonical Ubuntu LinuxNovell Suse Linux Enterprise Debuginfo+2 more
Timeline
PublishedMay 23
Latest updateMay 17

Description

The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶Debianlinux< 4.5.4-1+3

Also affects: Ubuntu Linux 12.04, 14.04, 15.10, 16.04

Patches

Patch: git.kernel.org ↗Patch: github.com ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-hqhf-q79j-98h4: The llc_cmsg_rcv function in net/llc/af_llc↗2022-05-17
▶
OSV
CVE-2016-4485: The llc_cmsg_rcv function in net/llc/af_llc↗2016-05-23
▶
CVEList
CVE-2016-4485: The llc_cmsg_rcv function in net/llc/af_llc↗2016-05-23
▶

📋Vendor Advisories

14
Ubuntu
Linux kernel vulnerabilities↗2016-06-10
▶
Ubuntu
Linux kernel (OMAP4) vulnerabilities↗2016-06-10
▶
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities↗2016-06-10
▶
Ubuntu
Linux kernel vulnerabilities↗2016-06-10
▶
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities↗2016-06-10
▶

💬Community

2
Bugzilla
CVE-2016-4485 CVE-2016-4486 kernel: various flaws [fedora-all]↗2016-05-05
▶
Bugzilla
CVE-2016-4485 kernel: Information leak in llc module↗2016-05-05
▶
CVE-2016-4485 (HIGH CVSS 7.5) | The llc_cmsg_rcv function in net/ll | cvebase.io