CVE-2016-8399
published 2017-01-12CVE-2016-8399: An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the…
PriorityP434high7CVSS 3.1
AVLACHPRNUIRSUCHIHAH
EPSS
2.34%
81.7th percentile
An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and current compiler optimizations restrict access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31349935.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.8.15-1 (bookworm) | linux 4.8.15-1 (bookworm) |
| android | — | — | |
| google_inc | android | — | — |
| google_inc | android | — | — |
| linux | linux_kernel | >= 0 < 4.8.15-1 | 4.8.15-1 |
| linux | linux_kernel | >= 0 < 4.8.15-1 | 4.8.15-1 |
| linux | linux_kernel | >= 0 < 4.8.15-1 | 4.8.15-1 |
| linux | linux_kernel | >= 0 < 4.8.15-1 | 4.8.15-1 |
| linux | linux_kernel | >= 0 < 4.4.0-62.83 | 4.4.0-62.83 |
| linux | linux_kernel | >= 3.19 < 4.1.37 | 4.1.37 |
| linux | linux_kernel | >= 4.2 < 4.4.38 | 4.4.38 |
| linux | linux_kernel | >= 4.5 < 4.8.14 | 4.8.14 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.07.6HIGHAV:N/AC:H/Au:N/C:C/I:C/A:C
osv7.0HIGH
vendor_debian7.0HIGH
vendor_redhat7.0HIGH
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jjrq-xfh3-2fg8: An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within
ghsa_unreviewed·2022-05-14
CVE-2016-8399 [HIGH] CWE-284 GHSA-jjrq-xfh3-2fg8: An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within
An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and current compiler optimizations restrict access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31349935.
OSV
linux-lts-xenial vulnerabilities
osv·2017-02-03·CVSS 5.5
[MEDIUM] linux-lts-xenial vulnerabilities
linux-lts-xenial vulnerabilities
USN-3189-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Mikulas Patocka discovered that the asynchronous multibuffer cryptographic
daemon (mcryptd) in the Linux kernel did not properly handle being invoked
with incompatible algorithms. A local attacker could use this to cause a
denial of service (system crash). (CVE-2016-10147)
Qidan He discovered that the ICMP implementation in the Linux kernel did
not properly check the size of an ICMP header. A local attacker with
CAP_NET_ADMIN could use this to expose sensitive information.
(CVE-2016-8399)
OSV
linux, linux-raspi2, linux-snapdragon vulnerabilities
osv·2017-02-03·CVSS 5.5
CVE-2016-10147 [MEDIUM] linux, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-raspi2, linux-snapdragon vulnerabilities
Mikulas Patocka discovered that the asynchronous multibuffer cryptographic
daemon (mcryptd) in the Linux kernel did not properly handle being invoked
with incompatible algorithms. A local attacker could use this to cause a
denial of service (system crash). (CVE-2016-10147)
Qidan He discovered that the ICMP implementation in the Linux kernel did
not properly check the size of an ICMP header. A local attacker with
CAP_NET_ADMIN could use this to expose sensitive information.
(CVE-2016-8399)
OSV
CVE-2016-8399: An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within
osv·2017-01-12·CVSS 7.0
CVE-2016-8399 [HIGH] CVE-2016-8399: An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within
An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and current compiler optimizations restrict access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31349935.
Kernel
net: ping: check minimum size on ICMP header length
kernel_security·2016-12-05
CVE-2016-8399 net: ping: check minimum size on ICMP header length
net: ping: check minimum size on ICMP header length
Prior to commit c0371da6047a ("put iov_iter into msghdr") in v3.19, there
was no check that the iovec contained enough bytes for an ICMP header,
and the read loop would walk across neighboring stack contents. Since the
iov_iter conversion, bad arguments are noticed, but the returned error is
EFAULT. Returning EINVAL is a clearer error and also solves the problem
prior to v3.19.
This was found using trinity with KASAN on v3.18:
BUG: KASAN: stack-out-of-bounds in memcpy_fromiovec+0x60/0x114 at addr ffffffc071077da0
Read of size 8 by task trinity-c2/9623
page:ffffffbe034b9a08 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x0()
page dumped because: kasan: bad access detected
CPU: 0 PID: 9623 Comm: trinity-c2 Tainted: G BU 3.18.0-dirt
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2017-02-10·CVSS 5.5
CVE-2016-10147 [MEDIUM] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mikulas Patocka discovered that the asynchronous multibuffer cryptographic
daemon (mcryptd) in the Linux kernel did not properly handle being invoked
with incompatible algorithms. A local attacker could use this to cause a
denial of service (system crash). (CVE-2016-10147)
It was discovered that a use-after-free existed in the KVM susbsystem of
the Linux kernel when creating devices. A local attacker could use this to
cause a denial of service (system crash). (CVE-2016-10150)
Qidan He discovered that the ICMP implementation in the Linux kernel did
not properly check the size of an ICMP header. A local attacker with
CAP_NET_ADMIN could use this to expose sensitive information.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-02-03·CVSS 5.5
CVE-2016-10147 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mikulas Patocka discovered that the asynchronous multibuffer cryptographic
daemon (mcryptd) in the Linux kernel did not properly handle being invoked
with incompatible algorithms. A local attacker could use this to cause a
denial of service (system crash). (CVE-2016-10147)
Qidan He discovered that the ICMP implementation in the Linux kernel did
not properly check the size of an ICMP header. A local attacker with
CAP_NET_ADMIN could use this to expose sensitive information.
(CVE-2016-8399)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-02-03·CVSS 5.5
CVE-2016-10147 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mikulas Patocka discovered that the asynchronous multibuffer cryptographic
daemon (mcryptd) in the Linux kernel did not properly handle being invoked
with incompatible algorithms. A local attacker could use this to cause a
denial of service (system crash). (CVE-2016-10147)
It was discovered that a use-after-free existed in the KVM susbsystem of
the Linux kernel when creating devices. A local attacker could use this to
cause a denial of service (system crash). (CVE-2016-10150)
Qidan He discovered that the ICMP implementation in the Linux kernel did
not properly check the size of an ICMP header. A local attacker with
CAP_NET_ADMIN could use this to expose sensitive information.
(CVE-2016-8399)
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2017-02-03·CVSS 5.5
CVE-2016-10147 [MEDIUM] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-3189-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
Mikulas Patocka discovered that the asynchronous multibuffer cryptographic
daemon (mcryptd) in the Linux kernel did not properly handle being invoked
with incompatible algorithms. A local attacker could use this to cause a
denial of service (system crash). (CVE-2016-10147)
Qidan He discovered that the ICMP implementation in the Linux kernel did
not properly check the size of an ICMP header. A local attacker with
CAP_NET_ADMIN could use this to expose sensitive informatio
Red Hat
kernel: net: Out of bounds stack read in memcpy_fromiovec
vendor_redhat·2016-12-05·CVSS 7.0
CVE-2016-8399 [HIGH] CWE-20 kernel: net: Out of bounds stack read in memcpy_fromiovec
kernel: net: Out of bounds stack read in memcpy_fromiovec
An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and current compiler optimizations restrict access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31349935.
A flaw was found in the Linux networking subsystem where a local attacker with CAP_NET_ADMIN capabilities could cause an out-of-bounds memory access by creating a smaller-than-expected ICMP header and sending to its destination via sendto().
Statement: This issue affects the Linux kernel packages as shipped with Re
Android
CVE-2016-8399: Android Security Bulletin 2016-12-01
CVE: CVE-2016-8399
Severity: MEDIUM
References: A-31349935*
vendor_android·2016-12-01·CVSS 7.0
CVE-2016-8399 [HIGH] CVE-2016-8399: Android Security Bulletin 2016-12-01
CVE: CVE-2016-8399
Severity: MEDIUM
References: A-31349935*
Android Security Bulletin 2016-12-01
CVE: CVE-2016-8399
Severity: MEDIUM
References: A-31349935*
Debian
CVE-2016-8399: linux - An elevation of privilege vulnerability in the kernel networking subsystem could...
vendor_debian·2016·CVSS 7.0
CVE-2016-8399 [HIGH] CVE-2016-8399: linux - An elevation of privilege vulnerability in the kernel networking subsystem could...
An elevation of privilege vulnerability in the kernel networking subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and current compiler optimizations restrict access to the vulnerable code. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31349935.
Scope: local
bookworm: resolved (fixed in 4.8.15-1)
bullseye: resolved (fixed in 4.8.15-1)
forky: resolved (fixed in 4.8.15-1)
sid: resolved (fixed in 4.8.15-1)
trixie: resolved (fixed in 4.8.15-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-8399 kernel: net: Out of bounds stack read in memcpy_fromiovec [fedora-all]
bugzilla·2016-12-12·CVSS 7.0
CVE-2016-8399 [HIGH] CVE-2016-8399 kernel: net: Out of bounds stack read in memcpy_fromiovec [fedora-all]
CVE-2016-8399 kernel: net: Out of bounds stack read in memcpy_fromiovec [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versi
Bugzilla
CVE-2016-8399 kernel: net: Out of bounds stack read in memcpy_fromiovec
bugzilla·2016-12-12·CVSS 7.0
CVE-2016-8399 [HIGH] CVE-2016-8399 kernel: net: Out of bounds stack read in memcpy_fromiovec
CVE-2016-8399 kernel: net: Out of bounds stack read in memcpy_fromiovec
A flaw was found in the Linux networking subsystem where a local attacker with CAP_NET_ADMIN capbilities could cause an out of bounds read by creating a smaller-than-expected ICMP header and sending to its destination via sendto().
Due to lack of size checking on ICMP header length, it is possible to cause out-of-bounds read on stack, this stack data may be included in the outgoing packet data if it can be validated (infoleak).
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0eab121ef8750a5c8637d51534d5e9143fb0633f
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1403834]
---
Statement:
This issue affects the Linux kernel packages as
http://rhn.redhat.com/errata/RHSA-2017-0817.htmlhttp://www.securityfocus.com/bid/94708https://access.redhat.com/errata/RHSA-2017:0869https://access.redhat.com/errata/RHSA-2017:2930https://access.redhat.com/errata/RHSA-2017:2931https://source.android.com/security/bulletin/2016-12-01.htmlhttps://support.f5.com/csp/article/K23030550?utm_source=f5support&%3Butm_medium=RSShttp://rhn.redhat.com/errata/RHSA-2017-0817.htmlhttp://www.securityfocus.com/bid/94708https://access.redhat.com/errata/RHSA-2017:0869https://access.redhat.com/errata/RHSA-2017:2930https://access.redhat.com/errata/RHSA-2017:2931https://source.android.com/security/bulletin/2016-12-01.htmlhttps://support.f5.com/csp/article/K23030550?utm_source=f5support&%3Butm_medium=RSS
2017-01-12
Published