CVE-2016-0728: Integer Overflow
First published: Mon Jan 11 2016(Updated: )
It was reported that possible use-after-free vulnerability in keyring facility, possibly leading to local privilege escalation, was found. Function join_session_keyring in security/keys/process_keys.c holds a reference to the requested keyring, but if that keyring is the same as the one being currently used by the process, the kernel wouldn't decrease keyring->usage before returning to userspace. The usage field can be possibly overflowed causing use-after-free on the keyring object. Introduced by: <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a50597de8635cd05133bd12c95681c82fe7b878">http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a50597de8635cd05133bd12c95681c82fe7b878</a> References: <a href="http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/">http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/</a> Red Hat KCS article: <a href="https://access.redhat.com/articles/2131021">https://access.redhat.com/articles/2131021</a> Upstream patch: <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2">https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | =4.0 | |
| Google Android | =4.0.1 | |
| Google Android | =4.0.2 | |
| Google Android | =4.0.3 | |
| Google Android | =4.0.4 | |
| Google Android | =4.1 | |
| Google Android | =4.1.2 | |
| Google Android | =4.2 | |
| Google Android | =4.2.1 | |
| Google Android | =4.2.2 | |
| Google Android | =4.3 | |
| Google Android | =4.3.1 | |
| Google Android | =4.4 | |
| Google Android | =4.4.1 | |
| Google Android | =4.4.2 | |
| Google Android | =4.4.3 | |
| Google Android | =5.0 | |
| Google Android | =5.0.1 | |
| Google Android | =5.0.2 | |
| Google Android | =5.1 | |
| Google Android | =5.1.0 | |
| Google Android | =5.1.1 | |
| Google Android | =6.0 | |
| Google Android | =6.0.1 | |
| Hp Server Migration Pack | <=7.5 | |
| Linux Linux kernel | >=3.8<3.10.95 | |
| Linux Linux kernel | >=3.11<3.12.53 | |
| Linux Linux kernel | >=3.13<3.14.59 | |
| Linux Linux kernel | >=3.15<3.16.35 | |
| Linux Linux kernel | >=3.17<3.18.26 | |
| Linux Linux kernel | >=3.19<4.1.16 | |
| Linux Linux kernel | >=4.2<4.3.4 | |
| Linux Linux kernel | >=4.4<4.4.1 | |
| Debian Debian Linux | =8.0 | |
| Canonical Ubuntu Linux | =12.04 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =15.04 | |
| Canonical Ubuntu Linux | =15.10 | |
| debian/linux | 4.19.249-2 4.19.289-2 5.10.197-1 5.10.191-1 6.1.66-1 6.1.69-1 6.5.13-1 6.6.9-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a50597de8635cd05133bd12c95681c82fe7b878
- http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
- https://access.redhat.com/articles/2131021
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
- https://access.redhat.com/node/2131021
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1116284
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1116284&action=edit
- https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=jessie-security&id=0ac8c3e88cf1ea329ede357f2a01a9b1a8734e24
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1297475#c13
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1297475#c11
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1116563
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1116563&action=edit
- https://rhn.redhat.com/errata/RHSA-2016-0065.html
- https://rhn.redhat.com/errata/RHSA-2016-0064.html
- https://rhn.redhat.com/errata/RHSA-2016-0068.html
- https://rhn.redhat.com/errata/RHSA-2016-0103.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1297475
- https://git.kernel.org/linus/23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
- https://git.kernel.org/linus/3a50597de8635cd05133bd12c95681c82fe7b878
- https://security-tracker.debian.org/tracker/CVE-2016-0728
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176194.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00034.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00039.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00040.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00041.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00043.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00045.html
- http://rhn.redhat.com/errata/RHSA-2016-0064.html
- http://rhn.redhat.com/errata/RHSA-2016-0065.html
- http://rhn.redhat.com/errata/RHSA-2016-0068.html
- http://source.android.com/security/bulletin/2016-03-01.html
- http://www.debian.org/security/2016/dsa-3448
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1
- http://www.openwall.com/lists/oss-security/2016/01/19/2
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/81054
- http://www.securitytracker.com/id/1034701
- http://www.ubuntu.com/usn/USN-2870-1
- http://www.ubuntu.com/usn/USN-2870-2
- http://www.ubuntu.com/usn/USN-2871-1
- http://www.ubuntu.com/usn/USN-2871-2
- http://www.ubuntu.com/usn/USN-2872-1
- http://www.ubuntu.com/usn/USN-2872-2
- http://www.ubuntu.com/usn/USN-2872-3
- http://www.ubuntu.com/usn/USN-2873-1
- https://bto.bluecoat.com/security-advisory/sa112
- https://github.com/torvalds/linux/commit/23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
- https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05018265
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05130958
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380
- https://security.netapp.com/advisory/ntap-20160211-0001/
- https://www.exploit-db.com/exploits/39277/
- collector/security-tracker-debian
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/references
- agent/last-modified-date
- agent/description
- agent/event
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-0728
- package-manager/debian
- vendor/google
- canonical/google android
- version/google android/4.0
- version/google android/4.0.1
- version/google android/4.0.2
- version/google android/4.0.3
- version/google android/4.0.4
- version/google android/4.1
- version/google android/4.1.2
- version/google android/4.2
- version/google android/4.2.1
- version/google android/4.2.2
- version/google android/4.3
- version/google android/4.3.1
- version/google android/4.4
- version/google android/4.4.1
- version/google android/4.4.2
- version/google android/4.4.3
- version/google android/5.0
- version/google android/5.0.1
- version/google android/5.0.2
- version/google android/5.1
- version/google android/5.1.0
- version/google android/5.1.1
- version/google android/6.0
- version/google android/6.0.1
- vendor/hp
- canonical/hp server migration pack
- version/hp server migration pack/7.5
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/3.8
- version/linux linux kernel/3.11
- version/linux linux kernel/3.13
- version/linux linux kernel/3.15
- version/linux linux kernel/3.17
- version/linux linux kernel/3.19
- version/linux linux kernel/4.2
- version/linux linux kernel/4.4
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/15.04
- version/canonical ubuntu linux/15.10