CVE-2016-6136
published 2016-08-06CVE-2016-6136: Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended…
PriorityP419medium4.7CVSS 3.0
AVLACHPRLUINSUCNIHAN
EPSS
0.27%
18.6th percentile
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.7.2-1 (bookworm) | linux 4.7.2-1 (bookworm) |
| android | — | — | |
| linux | linux_kernel | <= 4.7 | — |
| linux | linux_kernel | >= 0 < 4.7.2-1 | 4.7.2-1 |
| linux | linux_kernel | >= 0 < 4.7.2-1 | 4.7.2-1 |
| linux | linux_kernel | >= 0 < 4.7.2-1 | 4.7.2-1 |
| linux | linux_kernel | >= 0 < 4.7.2-1 | 4.7.2-1 |
| linux | linux_kernel | >= 0 < 3.13.0-98.145 | 3.13.0-98.145 |
| linux | linux_kernel | >= 0 < 4.4.0-38.57 | 4.4.0-38.57 |
CVSS provenance
nvdv3.04.7MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:N/I:P/A:N
osv6.5MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5q34-w3p7-2pvp: Race condition in the audit_log_single_execve_arg function in kernel/auditsc
ghsa_unreviewed·2022-05-14
CVE-2016-6136 [MEDIUM] CWE-362 GHSA-5q34-w3p7-2pvp: Race condition in the audit_log_single_execve_arg function in kernel/auditsc
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.
OSV
linux vulnerabilities
osv·2016-10-11·CVSS 4.7
CVE-2016-7039 [MEDIUM] linux vulnerabilities
linux vulnerabilities
Vladimír Beneš discovered an unbounded recursion in the VLAN and TEB
Generic Receive Offload (GRO) processing implementations in the Linux
kernel, A remote attacker could use this to cause a stack corruption,
leading to a denial of service (system crash). (CVE-2016-7039)
Marco Grassi discovered a use-after-free condition could occur in the TCP
retransmit queue handling code in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2016-6828)
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
Pengfei Wang discovered a race condition in the Adaptec AAC
OSV
linux-raspi2 vulnerabilities
osv·2016-09-19·CVSS 6.5
CVE-2016-6136 [MEDIUM] linux-raspi2 vulnerabilities
linux-raspi2 vulnerabilities
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
It was discovered that the powerpc and powerpc64 hypervisor-mode KVM
implementation in the Linux kernel for did not properly maintain state
about transactional memory. An unprivileged attacker in a guest could cause
a denial of service (CPU lockup) in the host OS. (CVE-2016-5412)
Pengfei Wang discovered a race condition in the Chrome OS embedded
controller device driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash). (CVE-2016-6156)
OSV
linux vulnerabilities
osv·2016-09-19·CVSS 6.5
CVE-2016-6136 [MEDIUM] linux vulnerabilities
linux vulnerabilities
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
It was discovered that the powerpc and powerpc64 hypervisor-mode KVM
implementation in the Linux kernel for did not properly maintain state
about transactional memory. An unprivileged attacker in a guest could cause
a denial of service (CPU lockup) in the host OS. (CVE-2016-5412)
Pengfei Wang discovered a race condition in the Chrome OS embedded
controller device driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash). (CVE-2016-6156)
OSV
linux-snapdragon vulnerabilities
osv·2016-09-19·CVSS 6.5
CVE-2016-6136 [MEDIUM] linux-snapdragon vulnerabilities
linux-snapdragon vulnerabilities
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
It was discovered that the powerpc and powerpc64 hypervisor-mode KVM
implementation in the Linux kernel for did not properly maintain state
about transactional memory. An unprivileged attacker in a guest could cause
a denial of service (CPU lockup) in the host OS. (CVE-2016-5412)
Pengfei Wang discovered a race condition in the Chrome OS embedded
controller device driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash). (CVE-2016-6156)
OSV
linux-lts-xenial vulnerabilities
osv·2016-09-19·CVSS 6.5
CVE-2016-6136 [MEDIUM] linux-lts-xenial vulnerabilities
linux-lts-xenial vulnerabilities
USN-3084-1 fixed vulnerabilities in the Linux kernel for Ubuntu
16.04 LTS. This update provides the corresponding updates for the
Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for
Ubuntu 14.04 LTS.
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
It was discovered that the powerpc and powerpc64 hypervisor-mode KVM
implementation in the Linux kernel for did not properly maintain state
about transactional memory. An unprivileged attacker in a guest could cause
a denial of service (CPU lockup) in the host OS. (CVE-2016-5412)
Pengfei Wang discovered a race condition in the Chrome OS embedded
controller dev
OSV
CVE-2016-6136: Race condition in the audit_log_single_execve_arg function in kernel/auditsc
osv·2016-08-06·CVSS 4.7
CVE-2016-6136 [MEDIUM] CVE-2016-6136: Race condition in the audit_log_single_execve_arg function in kernel/auditsc
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.
Android
CVE-2016-6136: Android Security Bulletin 2016-11-01
CVE: CVE-2016-6136
Severity: HIGH
References: A-30956807
Upstream
kernel
vendor_android·2016-11-01·CVSS 4.7
CVE-2016-6136 [MEDIUM] CVE-2016-6136: Android Security Bulletin 2016-11-01
CVE: CVE-2016-6136
Severity: HIGH
References: A-30956807
Upstream
kernel
Android Security Bulletin 2016-11-01
CVE: CVE-2016-6136
Severity: HIGH
References: A-30956807
Upstream
kernel
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2016-10-13·CVSS 4.7
CVE-2016-6136 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Marco Grassi discovered a use-after-free condition could occur in the TCP
retransmit queue handling code in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2016-6828)
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller
driver in the Linux kernel when handling ioctl()s. A local attacker could
use this to cause a denial of service (system crash). (CVE-2016-6480)
Instructions: After a standard
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-10-11·CVSS 4.7
CVE-2016-6136 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Marco Grassi discovered a use-after-free condition could occur in the TCP
retransmit queue handling code in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2016-6828)
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
Pengfei Wang discovered a race condition in the Adaptec AAC RAID controller
driver in the Linux kernel when handling ioctl()s. A local attacker could
use this to cause a denial of service (system crash). (CVE-2016-6480)
Instructions: After a standard system
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2016-10-11·CVSS 4.7
CVE-2016-6136 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-3098-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 LTS.
Marco Grassi discovered a use-after-free condition could occur in the TCP
retransmit queue handling code in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2016-6828)
Vladimír Beneš discovered an unbounded recursion in the VLAN and TEB
Generic Receive Offload (GRO) processing implementations in the Linux
kernel, A remote attacker could use this to cause a stack corruption,
leading to a
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-10-11·CVSS 4.7
CVE-2016-6136 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Vladimír Beneš discovered an unbounded recursion in the VLAN and TEB
Generic Receive Offload (GRO) processing implementations in the Linux
kernel, A remote attacker could use this to cause a stack corruption,
leading to a denial of service (system crash). (CVE-2016-7039)
Marco Grassi discovered a use-after-free condition could occur in the TCP
retransmit queue handling code in the Linux kernel. A local attacker could
use this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2016-6828)
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CV
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2016-09-19·CVSS 6.5
CVE-2016-5412 [MEDIUM] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
It was discovered that the powerpc and powerpc64 hypervisor-mode KVM
implementation in the Linux kernel for did not properly maintain state
about transactional memory. An unprivileged attacker in a guest could cause
a denial of service (CPU lockup) in the host OS. (CVE-2016-5412)
Pengfei Wang discovered a race condition in the Chrome OS embedded
controller device driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash). (CVE-2016-6156)
Instruct
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2016-09-19·CVSS 6.5
CVE-2016-5412 [MEDIUM] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-3084-1 fixed vulnerabilities in the Linux kernel for Ubuntu
16.04 LTS. This update provides the corresponding updates for the
Linux Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for
Ubuntu 14.04 LTS.
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
It was discovered that the powerpc and powerpc64 hypervisor-mode KVM
implementation in the Linux kernel for did not properly maintain state
about transactional memory. An unprivileged attacker in a guest could cause
a denial of service (CPU lockup) in the host OS. (CVE-2016-5412)
Pengf
Ubuntu
Linux kernel (Qualcomm Snapdragon) vulnerabilities
vendor_ubuntu·2016-09-19·CVSS 6.5
CVE-2016-5412 [MEDIUM] Linux kernel (Qualcomm Snapdragon) vulnerabilities
Title: Linux kernel (Qualcomm Snapdragon) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
It was discovered that the powerpc and powerpc64 hypervisor-mode KVM
implementation in the Linux kernel for did not properly maintain state
about transactional memory. An unprivileged attacker in a guest could cause
a denial of service (CPU lockup) in the host OS. (CVE-2016-5412)
Pengfei Wang discovered a race condition in the Chrome OS embedded
controller device driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash). (CVE-2016-6156)
Ins
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-09-19·CVSS 6.5
CVE-2016-5412 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Pengfei Wang discovered a race condition in the audit subsystem in the
Linux kernel. A local attacker could use this to corrupt audit logs or
disrupt system-call auditing. (CVE-2016-6136)
It was discovered that the powerpc and powerpc64 hypervisor-mode KVM
implementation in the Linux kernel for did not properly maintain state
about transactional memory. An unprivileged attacker in a guest could cause
a denial of service (CPU lockup) in the host OS. (CVE-2016-5412)
Pengfei Wang discovered a race condition in the Chrome OS embedded
controller device driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash). (CVE-2016-6156)
Instructions: After a sta
Red Hat
kernel: Race condition vulnerability in execve argv arguments
vendor_redhat·2016-07-04·CVSS 4.7
CVE-2016-6136 [MEDIUM] CWE-362 kernel: Race condition vulnerability in execve argv arguments
kernel: Race condition vulnerability in execve argv arguments
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.
When creating audit records for parameters to executed children processes, an attacker can convince the Linux kernel audit subsystem can create corrupt records which may allow an attacker to misrepresent or evade logging of executing commands.
Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and 7. This has been rated as having Moderate security impact and is planned to be addressed in future updates. For
Debian
CVE-2016-6136: linux - Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c i...
vendor_debian·2016·CVSS 4.7
CVE-2016-6136 [MEDIUM] CVE-2016-6136: linux - Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c i...
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.
Scope: local
bookworm: resolved (fixed in 4.7.2-1)
bullseye: resolved (fixed in 4.7.2-1)
forky: resolved (fixed in 4.7.2-1)
sid: resolved (fixed in 4.7.2-1)
trixie: resolved (fixed in 4.7.2-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-6136 kernel: Race condition vulnerability in execve argv arguments
bugzilla·2016-07-07·CVSS 4.7
CVE-2016-6136 [MEDIUM] CVE-2016-6136 kernel: Race condition vulnerability in execve argv arguments
CVE-2016-6136 kernel: Race condition vulnerability in execve argv arguments
In function audit_log_single_execve_arg(), the whole argument is fetched from user space twice via copy_from_user(). In the first loop, it is firstly fetched (line 1038) to verify, aka looking for non-ascii chars. While in the second loop, the whole argument is fetched again (line 1105) from user space and used at line 1121 and line 1123 respectively depends on the previous verification.
Upstream bug:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-6136
https://bugzilla.kernel.org/show_bug.cgi?id=120681
https://github.com/linux-audit/audit-kernel/issues/18
https://www.redhat.com/archives/linux-audit/2016-June/msg00029.html
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Bugzilla
CVE-2016-6136 kernel: Race condition vulnerability in auditsc.c [fedora-all]
bugzilla·2016-07-07·CVSS 4.7
CVE-2016-6136 [MEDIUM] CVE-2016-6136 kernel: Race condition vulnerability in auditsc.c [fedora-all]
CVE-2016-6136 kernel: Race condition vulnerability in auditsc.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of F
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=43761473c254b45883a64441dd0bc85a42f3645chttp://rhn.redhat.com/errata/RHSA-2016-2574.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2584.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0307.htmlhttp://www.securityfocus.com/archive/1/538835/30/0/threadedhttp://www.securityfocus.com/bid/91558https://bugzilla.kernel.org/show_bug.cgi?id=120681https://bugzilla.redhat.com/show_bug.cgi?id=1353533https://github.com/linux-audit/audit-kernel/issues/18https://github.com/torvalds/linux/commit/43761473c254b45883a64441dd0bc85a42f3645chttps://source.android.com/security/bulletin/2016-11-01.htmlhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=43761473c254b45883a64441dd0bc85a42f3645chttp://rhn.redhat.com/errata/RHSA-2016-2574.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2584.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0307.htmlhttp://www.securityfocus.com/archive/1/538835/30/0/threadedhttp://www.securityfocus.com/bid/91558https://bugzilla.kernel.org/show_bug.cgi?id=120681https://bugzilla.redhat.com/show_bug.cgi?id=1353533https://github.com/linux-audit/audit-kernel/issues/18https://github.com/torvalds/linux/commit/43761473c254b45883a64441dd0bc85a42f3645chttps://source.android.com/security/bulletin/2016-11-01.html
2016-08-06
Published