CVE-2016-9576
published 2016-12-28CVE-2016-9576: The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.44%
36.0th percentile
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.8.15-1 (bookworm) | linux 4.8.15-1 (bookworm) |
| debian | linux | < linux 4.8.15-2 (bookworm) | linux 4.8.15-2 (bookworm) |
| linux | linux_kernel | < 3.10.107 | 3.10.107 |
| linux | linux_kernel | >= 0 < 4.8.15-2 | 4.8.15-2 |
| linux | linux_kernel | >= 0 < 4.8.15-1 | 4.8.15-1 |
| linux | linux_kernel | >= 0 < 4.8.15-2 | 4.8.15-2 |
| linux | linux_kernel | >= 0 < 4.8.15-1 | 4.8.15-1 |
| linux | linux_kernel | >= 0 < 4.8.15-2 | 4.8.15-2 |
| linux | linux_kernel | >= 0 < 4.8.15-1 | 4.8.15-1 |
| linux | linux_kernel | >= 0 < 4.8.15-2 | 4.8.15-2 |
| linux | linux_kernel | >= 0 < 4.8.15-1 | 4.8.15-1 |
| linux | linux_kernel | >= 3.11 < 3.12.70 | 3.12.70 |
| linux | linux_kernel | >= 3.13 < 3.16.40 | 3.16.40 |
| linux | linux_kernel | >= 3.17 < 3.18.47 | 3.18.47 |
| linux | linux_kernel | >= 3.19 < 4.1.38 | 4.1.38 |
| linux | linux_kernel | >= 4.0 < 4.4.38 | 4.4.38 |
| linux | linux_kernel | >= 4.2 < 4.4.41 | 4.4.41 |
| linux | linux_kernel | >= 4.5 < 4.8.14 | 4.8.14 |
| linux | linux_kernel | >= 4.5 < 4.8.17 | 4.8.17 |
| linux | linux_kernel | >= 4.9 < 4.9.2 | 4.9.2 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
vendor_redhat·2017-01-11·CVSS 7.0
CVE-2016-10088 [HIGH] CWE-416 kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
It was found that the fix for CVE-2016-9576 was incomplete: the Linux kernel's sg implementation did not properly restrict write operations in situations where the KERNEL_DS option is set. A local attacker to read or write to arbitrary kernel memory locations or cause a deni
Red Hat
kernel: Use after free in SCSI generic device interface
vendor_redhat·2016-11-25·CVSS 7.8
CVE-2016-9576 [HIGH] CWE-416 kernel: Use after free in SCSI generic device interface
kernel: Use after free in SCSI generic device interface
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
It was found that the blk_rq_map_user_iov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux
Debian
CVE-2016-9576: linux - The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4...
vendor_debian·2016·CVSS 7.8
CVE-2016-9576 [HIGH] CVE-2016-9576: linux - The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4...
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
Scope: local
bookworm: resolved (fixed in 4.8.15-1)
bullseye: resolved (fixed in 4.8.15-1)
forky: resolved (fixed in 4.8.15-1)
sid: resolved (fixed in 4.8.15-1)
trixie: resolved (fixed in 4.8.15-1)
Debian
CVE-2016-10088: linux - The sg implementation in the Linux kernel through 4.9 does not properly restrict...
vendor_debian·2016·CVSS 7.0
CVE-2016-10088 [HIGH] CVE-2016-10088: linux - The sg implementation in the Linux kernel through 4.9 does not properly restrict...
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
Scope: local
bookworm: resolved (fixed in 4.8.15-2)
bullseye: resolved (fixed in 4.8.15-2)
forky: resolved (fixed in 4.8.15-2)
sid: resolved (fixed in 4.8.15-2)
trixie: resolved (fixed in 4.8.15-2)
GHSA
GHSA-m9p4-r7pw-hpw3: The sg implementation in the Linux kernel through 4
ghsa_unreviewed·2022-05-14·CVSS 7.8
CVE-2016-10088 [HIGH] CWE-416 GHSA-m9p4-r7pw-hpw3: The sg implementation in the Linux kernel through 4
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
GHSA
GHSA-q25h-fm3c-jgp6: The blk_rq_map_user_iov function in block/blk-map
ghsa_unreviewed·2022-05-14
CVE-2016-9576 [HIGH] CWE-416 GHSA-q25h-fm3c-jgp6: The blk_rq_map_user_iov function in block/blk-map
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
OSV
CVE-2016-10088: The sg implementation in the Linux kernel through 4
osv·2016-12-30·CVSS 7.0
CVE-2016-10088 [HIGH] CVE-2016-10088: The sg implementation in the Linux kernel through 4
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
OSV
CVE-2016-9576: The blk_rq_map_user_iov function in block/blk-map
osv·2016-12-28·CVSS 7.8
CVE-2016-9576 [HIGH] CVE-2016-9576: The blk_rq_map_user_iov function in block/blk-map
The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-10088 kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
bugzilla·2017-01-11·CVSS 7.0
CVE-2016-10088 [HIGH] CVE-2016-10088 kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
CVE-2016-10088 kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression)
The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
References:
http://seclists.org/oss-sec/2016/q4/779
Upstream patch:
https://git.kernel.org/linus/128394eff343fc6d2f32172f03e24829539c5835
This is an additional fix for CVE-2016-9576, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1403145
Discussion:
S
Bugzilla
CVE-2016-9576 kernel: Use after free in SCSI generic device interface
bugzilla·2016-12-09·CVSS 7.0
CVE-2016-9576 [HIGH] CVE-2016-9576 kernel: Use after free in SCSI generic device interface
CVE-2016-9576 kernel: Use after free in SCSI generic device interface
Use-after-free vulnerability in SCSI generic device interface has been reported which allows kernel memory read/write when having access to /dev/sg* SCSI generic devices. This issue affects versions of Linux down to 2.6. This was assigned CVE-2016-9576.
Initial message:
https://www.spinics.net/lists/linux-scsi/msg102232.html
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ac402cfcdc904f9772e1762b3fda112dcc56a0
Oss-security post:
http://seclists.org/oss-sec/2016/q4/644
Later an additional fix was developed, it was assigned CVE-2016-10088, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1412210
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora
Bugzilla
CVE-2016-9576 CVE-2016-10088 kernel: Use after free in SCSI generic device interface [fedora-all]
bugzilla·2016-12-09·CVSS 7.0
CVE-2016-9576 [HIGH] CVE-2016-9576 CVE-2016-10088 kernel: Use after free in SCSI generic device interface [fedora-all]
CVE-2016-9576 CVE-2016-10088 kernel: Use after free in SCSI generic device interface [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple su
arXiv
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
arxiv_fulltext·2025-11-21
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
Characteristics, Root Causes, and Detection of
Incomplete Security Bug Fixes in the Linux Kernel
Qiang Liu^1All work was done by Aug., 2022.,
Wenlong Zhang^1,
Muhui Jiang^2,1,
Lei Wu^1,
Yajin Zhou^1
^1Zhejiang University,
^2The Hong Kong Polytechnic University
## Abstract
Security bugs in the Linux kernel emerge endlessly and have attracted much
attention.
However, fixing security bugs in the Linux kernel could be incomplete due to
human mistakes.
Specifically, an incomplete fix fails to repair all the original security
defects in the software, fails to properly repair the original security defects,
or introduces new ones.
In this paper, we study the fixes of incomplete security bugs in the Linux
kernel for the first time, and reveal their characteristics, root causes as well
as de
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ac402cfcdc904f9772e1762b3fda112dcc56a0http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00057.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00072.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00075.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00081.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00088.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00091.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0817.htmlhttp://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.14http://www.openwall.com/lists/oss-security/2016/12/08/19http://www.securityfocus.com/bid/94821https://access.redhat.com/errata/RHSA-2017:1842https://access.redhat.com/errata/RHSA-2017:2077https://access.redhat.com/errata/RHSA-2017:2669https://bugzilla.redhat.com/show_bug.cgi?id=1403145https://github.com/torvalds/linux/commit/a0ac402cfcdc904f9772e1762b3fda112dcc56a0http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ac402cfcdc904f9772e1762b3fda112dcc56a0http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00040.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00057.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00062.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00072.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00075.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00081.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00088.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-12/msg00091.htmlhttp://rhn.redhat.com/errata/RHSA-2017-0817.htmlhttp://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.14http://www.openwall.com/lists/oss-security/2016/12/08/19http://www.securityfocus.com/bid/94821https://access.redhat.com/errata/RHSA-2017:1842https://access.redhat.com/errata/RHSA-2017:2077https://access.redhat.com/errata/RHSA-2017:2669https://bugzilla.redhat.com/show_bug.cgi?id=1403145https://github.com/torvalds/linux/commit/a0ac402cfcdc904f9772e1762b3fda112dcc56a0
2016-12-28
Published