CVE-2016-0774: Input Validation
It was found that the fix for CVE-2015-1805 incorrectly kept buffer offset and buffer length in sync on failed atomic read, potentially resulting in pipe buffer state corruption.
A local, unprivileged user could use this flaw to crash the system or leak kernel memory to user-space.
Upstream Linux kernel is not affected by this flaw as it was introduced by the Red Hat Enterprise Linux only fix for CVE-2015-1805.
Acknowledgements:
The security impact of this issue was discovered by Red Hat.
Other sources
The (1) piperead and (2) pipewrite implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed copytouserinatomic and copyfromuserinatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2016-0774.
What is the severity of CVE-2016-0774?
CVE-2016-0774 has a severity level of medium.
Which Linux versions are affected by CVE-2016-0774?
The linux package before version 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before version 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 are affected by CVE-2016-0774.
How can I fix CVE-2016-0774 on Ubuntu?
To fix CVE-2016-0774 on Ubuntu, update the linux package to version 3.2.0-102.142 (for precise) or 3.13.0-86.130 (for trusty).
How can I fix CVE-2016-0774 on Debian?
To fix CVE-2016-0774 on Debian, update the linux package to a version that includes the fix, such as 4.19.249-2, 4.19.289-2, 5.10.178-3, 5.10.191-1, 6.1.38-1, 6.1.52-1, or 6.5.3-1.