CVE-2016-2085: Medium severity Linux Linux kernel vulnerability
A timing side channel vulnerability was discovered in the Linux Extended Verification Module (EVM). An attacker could use this to affect system integrity.
The problem exists because the vmverifyhmac() function includes a use of memcmp(). This function is not safe to be used for comparing memory, allows timing side channel attacks; specifically a MAC forgery complexity drop from 2^128 to 2^12. This patch changes the memcmp() to the cryptographically safe cryptomemneq().
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=613317bd212c585c20796c10afe5daaa95d4b0a1
Original bug report:
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2085.html
Other sources
The evmverifyhmac function in security/integrity/evm/evmmain.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2016-2085.
What is the severity of CVE-2016-2085?
The severity of CVE-2016-2085 is medium.
What is the affected software?
The affected software is Linux kernel versions before 4.5.
How does CVE-2016-2085 affect the Linux kernel?
CVE-2016-2085 makes it easier for local users to forge MAC values via a timing side-channel attack.
How can I fix CVE-2016-2085?
To fix CVE-2016-2085, update your Linux kernel to version 4.5 or later.