CVE-2016-0758: Integer Overflow
An issue with ASN.1 DER decoder was reported that could lead to memory corruptions, possible privilege escalation, or complete local denial of service via x509 certificate DER files.
Tags with indefinite length can be used to corrupt the dp and len pointers in asn1findindefinitelength() in lib/asn1decoder.c
Vulnerable code:
... nexttag: if (unlikely(datalen - dp < 2)) { if (datalen == dp) goto missingeoc; goto dataoverrunerror; } ... n = len - 0x80; if (unlikely(n > sizeof(sizet) - 1)) goto lengthtoolong; if (unlikely(n > datalen - dp)) goto dataoverrunerror; for (len = 0; n > 0; n--) { len <<= 8; len |= data[dp++]; } dp += len; goto nexttag; ...
dp can be corrupted and the check at nexttag is not sufficient to prevent this.
Upstream fix: https://lkml.org/lkml/2016/5/12/270
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa
Other sources
Integer overflow in lib/asn1decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0758?
CVE-2016-0758 has a high severity rating as it allows local users to potentially gain elevated privileges through crafted ASN.1 data.
How do I fix CVE-2016-0758?
To mitigate CVE-2016-0758, update your Linux kernel to version 4.6 or later to address the integer overflow vulnerability.
Which systems are affected by CVE-2016-0758?
CVE-2016-0758 affects various systems running Linux kernel versions before 4.6, including certain distributions of Red Hat, Ubuntu, and Google Android.
What are the potential consequences of CVE-2016-0758?
Exploitation of CVE-2016-0758 could lead to memory corruption, privilege escalation, or local denial of service.
Is there a known attack vector for CVE-2016-0758?
The known attack vector for CVE-2016-0758 involves local users exploiting crafted ASN.1 data.