CVE-2016-6198

CWE-284 — Improper Access ControlCWE-362 — Race Condition8 documents7 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 89.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux Linux KernelOracle LinuxOracle VM Server
Timeline
PublishedAug 6
Latest updateMay 13

Description

The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶Debianlinux< 4.5.5-1+3

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-pvqg-4394-gpjv: The filesystem layer in the Linux kernel before 4↗2022-05-13
▶
CVEList
CVE-2016-6198: The filesystem layer in the Linux kernel before 4↗2016-08-06
▶
OSV
CVE-2016-6198: The filesystem layer in the Linux kernel before 4↗2016-08-06
▶

📋Vendor Advisories

2
Red Hat
kernel: vfs: missing detection of hardlinks in vfs_rename() on overlayfs↗2016-07-11
▶
Debian
CVE-2016-6198: linux - The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename ...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-6198 kernel: vfs: missing detection of hardlinks in vfs_rename() on overlayfs [fedora-all]↗2016-07-12
▶
Bugzilla
CVE-2016-6198 kernel: vfs: missing detection of hardlinks in vfs_rename() on overlayfs↗2016-07-12
▶
CVE-2016-6198 (MEDIUM CVSS 5.5) | The filesystem layer in the Linux k | cvebase.io