UBUNTU-CVE-2016-4557
The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.
02 / AFFECTED SOFTWARE
Affected packages
5 explicit affected versions
24 explicit affected versions
6 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.
05 / REFERENCES
Further evidence
- http://www.openwall.com/lists/oss-security/2016/05/06/7
- https://bugs.chromium.org/p/project-zero/issues/detail?id=808
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7
- https://ubuntu.com/security/CVE-2016-4557
- https://ubuntu.com/security/notices/USN-2965-1
- https://ubuntu.com/security/notices/USN-2965-2
- https://ubuntu.com/security/notices/USN-2965-3
- https://ubuntu.com/security/notices/USN-2965-4
- https://www.cve.org/CVERecord?id=CVE-2016-4557