CVE-2016-7425
published 2016-10-16CVE-2016-7425: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.43%
35.4th percentile
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 4.7.8-1 (bookworm) | linux 4.7.8-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 4.7.8-1 | 4.7.8-1 |
| linux | linux_kernel | >= 0 < 3.13.0-103.150 | 3.13.0-103.150 |
| linux | linux_kernel | >= 0 < 4.4.0-51.72 | 4.4.0-51.72 |
| linux | linux_kernel | >= 3.11 < 3.12.67 | 3.12.67 |
| linux | linux_kernel | >= 3.13 < 3.16.39 | 3.16.39 |
| linux | linux_kernel | >= 3.17 < 3.18.46 | 3.18.46 |
| linux | linux_kernel | >= 3.19 < 4.1.37 | 4.1.37 |
| linux | linux_kernel | >= 3.2 < 3.2.84 | 3.2.84 |
| linux | linux_kernel | >= 3.3 < 3.10.105 | 3.10.105 |
| linux | linux_kernel | >= 4.2 < 4.4.27 | 4.4.27 |
| linux | linux_kernel | >= 4.5 < 4.7.10 | 4.7.10 |
| linux | linux_kernel | >= 4.8 < 4.8.4 | 4.8.4 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use
Ubuntu
Linux kernel (Qualcomm Snapdragon) vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] Linux kernel (Qualcomm Snapdragon) vulnerabilities
Title: Linux kernel (Qualcomm Snapdragon) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker coul
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2016-12-20·CVSS 4.7
CVE-2016-6213 [MEDIUM] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during a
setxattr call. A local attacker could use this to possibly elevate group
privileges. (CVE-2016-7097)
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system crash
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-11-30·CVSS 4.4
CVE-2016-7097 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the __get_user_asm_ex implementation in the Linux
kernel for x86/x86_64 contained extended asm statements that were
incompatible with the exception table. A local attacker could use this to
gain administrative privileges. (CVE-2016-9644)
Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during a
setxattr call. A local attacker could use this to possibly elevate group
privileges. (CVE-2016-7097)
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system cr
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2016-11-30
CVE-2016-7425 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system could be made to crash under certain conditions.
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system crash) or possibly gain
privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linux-powerp
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2016-11-30·CVSS 4.4
CVE-2016-7097 [MEDIUM] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-3146-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that the __get_user_asm_ex implementation in the Linux
kernel for x86/x86_64 contained extended asm statements that were
incompatible with the exception table. A local attacker could use this to
gain administrative privileges. (CVE-2016-9644)
Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during a
setxattr call. A local attacker could use this to possibly elevate group
priv
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2016-11-30·CVSS 7.8
CVE-2016-7425 [HIGH] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-3145-1 fixed vulnerabilities in the Linux kernel for Ubuntu
14.04 LTS. This update provides the corresponding updates for the
Linux Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for
Ubuntu 12.04 LTS.
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system crash) or possibly gain
privileges. (CVE-2016-7425)
Daxing Guo discovered a stack-based buffer overflow in the Broadcom
IEEE802.11n FullMAC driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash) or possibly gain
privileges. (C
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-11-30·CVSS 4.4
CVE-2016-7097 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during a
setxattr call. A local attacker could use this to possibly elevate group
privileges. (CVE-2016-7097)
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system crash) or possibly gain
privileges. (CVE-2016-7425)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version numb
Ubuntu
Linux kernel (OMAP4) vulnerability
vendor_ubuntu·2016-11-30
CVE-2016-7425 Linux kernel (OMAP4) vulnerability
Title: Linux kernel (OMAP4) vulnerability
Summary: The system could be made to crash under certain conditions.
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system crash) or possibly gain
privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unless you manually uninstalled the standard kernel metapackages
(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,
linu
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-11-30·CVSS 7.8
CVE-2016-7425 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system crash) or possibly gain
privileges. (CVE-2016-7425)
Daxing Guo discovered a stack-based buffer overflow in the Broadcom
IEEE802.11n FullMAC driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash) or possibly gain
privileges. (CVE-2016-8658)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version numbe
Red Hat
kernel: SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer()
vendor_redhat·2016-09-15·CVSS 7.8
CVE-2016-7425 [HIGH] CWE-122 kernel: SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer()
kernel: SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer()
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
A heap-buffer overflow vulnerability was found in the arcmsr_iop_message_xfer() function in 'drivers/scsi/arcmsr/arcmsr_hba.c' file in the Linux kernel through 4.8.2. The function does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. This can potentially cause kernel heap corruption and arbitrary kernel code e
Debian
CVE-2016-7425: linux - The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the ...
vendor_debian·2016·CVSS 7.8
CVE-2016-7425 [HIGH] CVE-2016-7425: linux - The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the ...
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
Scope: local
bookworm: resolved (fixed in 4.7.8-1)
bullseye: resolved (fixed in 4.7.8-1)
forky: resolved (fixed in 4.7.8-1)
sid: resolved (fixed in 4.7.8-1)
trixie: resolved (fixed in 4.7.8-1)
GHSA
GHSA-268m-95p3-rgg5: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba
ghsa_unreviewed·2022-05-17
CVE-2016-7425 [HIGH] CWE-119 GHSA-268m-95p3-rgg5: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
OSV
linux-snapdragon vulnerabilities
osv·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] linux-snapdragon vulnerabilities
linux-snapdragon vulnerabilities
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
Andreas Grue
OSV
linux-raspi2 vulnerabilities
osv·2016-12-20·CVSS 5.5
CVE-2015-8964 [MEDIUM] linux-raspi2 vulnerabilities
linux-raspi2 vulnerabilities
Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the
TTY implementation in the Linux kernel. A local attacker could use this to
expose sensitive information (kernel memory). (CVE-2015-8964)
It was discovered that the Video For Linux Two (v4l2) implementation in the
Linux kernel did not properly handle multiple planes when processing a
VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)
CAI Qian discovered that shared bind mounts in a mount namespace
exponentially added entries without restriction to the Linux kernel's mount
table. A local attacker could use this to cause a denial of service (system
crash). (CVE-2016-6213)
Ondrej Kozina di
OSV
linux vulnerabilities
osv·2016-11-30·CVSS 7.8
CVE-2016-7425 [HIGH] linux vulnerabilities
linux vulnerabilities
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system crash) or possibly gain
privileges. (CVE-2016-7425)
Daxing Guo discovered a stack-based buffer overflow in the Broadcom
IEEE802.11n FullMAC driver in the Linux kernel. A local attacker could use
this to cause a denial of service (system crash) or possibly gain
privileges. (CVE-2016-8658)
OSV
linux vulnerabilities
osv·2016-11-30·CVSS 4.4
CVE-2016-9644 [MEDIUM] linux vulnerabilities
linux vulnerabilities
It was discovered that the __get_user_asm_ex implementation in the Linux
kernel for x86/x86_64 contained extended asm statements that were
incompatible with the exception table. A local attacker could use this to
gain administrative privileges. (CVE-2016-9644)
Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during a
setxattr call. A local attacker could use this to possibly elevate group
privileges. (CVE-2016-7097)
Marco Grassi discovered that the driver for Areca RAID Controllers in the
Linux kernel did not properly validate control messages. A local attacker
could use this to cause a denial of service (system crash) or possibly gain
privileges. (CVE-2016-7425)
Daxing Guo discovered a
OSV
linux-lts-xenial vulnerabilities
osv·2016-11-30·CVSS 4.4
[MEDIUM] linux-lts-xenial vulnerabilities
linux-lts-xenial vulnerabilities
USN-3146-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that the __get_user_asm_ex implementation in the Linux
kernel for x86/x86_64 contained extended asm statements that were
incompatible with the exception table. A local attacker could use this to
gain administrative privileges. (CVE-2016-9644)
Andreas Gruenbacher and Jan Kara discovered that the filesystem
implementation in the Linux kernel did not clear the setgid bit during a
setxattr call. A local attacker could use this to possibly elevate group
privileges. (CVE-2016-7097)
Marco Grassi discovered that the driver for Areca R
OSV
CVE-2016-7425: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba
osv·2016-10-16·CVSS 7.8
CVE-2016-7425 [HIGH] CVE-2016-7425: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba
The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-7425 kernel: SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer() [fedora-all]
bugzilla·2016-09-19·CVSS 7.8
CVE-2016-7425 [HIGH] CVE-2016-7425 kernel: SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer() [fedora-all]
CVE-2016-7425 kernel: SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer() [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2016-7425 kernel: SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer()
bugzilla·2016-09-19·CVSS 7.8
CVE-2016-7425 [HIGH] CVE-2016-7425 kernel: SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer()
CVE-2016-7425 kernel: SCSI arcmsr driver: Buffer overflow in arcmsr_iop_message_xfer()
A heap-buffer overflow vulnerability was found in the arcmsr_iop_message_xfer() function in 'drivers/scsi/arcmsr/arcmsr_hba.c' file in the Linux kernel through 4.8.2. The function does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code. This can potentially cause kernel heap corruption and arbitrary kernel code execution.
Upstream patch:
http://marc.info/?l=linux-scsi&m=147394713328707&w=2
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7bc2b55a5c030685b399bb65b6baa9ccc3d1f167
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4bd173c30792791
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7bc2b55a5c030685b399bb65b6baa9ccc3d1f167http://marc.info/?l=linux-scsi&m=147394713328707&w=2http://marc.info/?l=linux-scsi&m=147394796228991&w=2http://www.openwall.com/lists/oss-security/2016/09/17/2http://www.securityfocus.com/bid/93037http://www.ubuntu.com/usn/USN-3144-1http://www.ubuntu.com/usn/USN-3144-2http://www.ubuntu.com/usn/USN-3145-1http://www.ubuntu.com/usn/USN-3145-2http://www.ubuntu.com/usn/USN-3146-1http://www.ubuntu.com/usn/USN-3146-2http://www.ubuntu.com/usn/USN-3147-1https://bugzilla.redhat.com/show_bug.cgi?id=1377330https://github.com/torvalds/linux/commit/7bc2b55a5c030685b399bb65b6baa9ccc3d1f167https://security-tracker.debian.org/tracker/CVE-2016-7425http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7bc2b55a5c030685b399bb65b6baa9ccc3d1f167http://marc.info/?l=linux-scsi&m=147394713328707&w=2http://marc.info/?l=linux-scsi&m=147394796228991&w=2http://www.openwall.com/lists/oss-security/2016/09/17/2http://www.securityfocus.com/bid/93037http://www.ubuntu.com/usn/USN-3144-1http://www.ubuntu.com/usn/USN-3144-2http://www.ubuntu.com/usn/USN-3145-1http://www.ubuntu.com/usn/USN-3145-2http://www.ubuntu.com/usn/USN-3146-1http://www.ubuntu.com/usn/USN-3146-2http://www.ubuntu.com/usn/USN-3147-1https://bugzilla.redhat.com/show_bug.cgi?id=1377330https://github.com/torvalds/linux/commit/7bc2b55a5c030685b399bb65b6baa9ccc3d1f167https://security-tracker.debian.org/tracker/CVE-2016-7425
2016-10-16
Published