CVE-2016-0728: Integer Overflow
It was reported that possible use-after-free vulnerability in keyring facility, possibly leading to local privilege escalation, was found. Function joinsessionkeyring in security/keys/processkeys.c holds a reference to the requested keyring, but if that keyring is the same as the one being currently used by the process, the kernel wouldn't decrease keyring->usage before returning to userspace. The usage field can be possibly overflowed causing use-after-free on the keyring object.
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a50597de8635cd05133bd12c95681c82fe7b878
References: http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
Red Hat KCS article: https://access.redhat.com/articles/2131021
Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
Other sources
The joinsessionkeyring function in security/keys/processkeys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0728?
CVE-2016-0728 has been classified as a high-severity vulnerability due to its capability to potentially lead to local privilege escalation.
How do I fix CVE-2016-0728?
Fix CVE-2016-0728 by upgrading your Linux kernel to the specified patched versions which include 4.19.249-2 or later.
Which versions of Linux are affected by CVE-2016-0728?
CVE-2016-0728 affects multiple versions of Linux, including certain releases of the Linux kernel prior to the patched versions.
Is there a workaround for CVE-2016-0728?
A direct workaround for CVE-2016-0728 is not recommended; the safest resolution is to update to a patched version.
What types of systems are impacted by CVE-2016-0728?
CVE-2016-0728 impacts systems running affected versions of the Linux kernel across various distributions, including Debian and Ubuntu.