CVE-2016-2383: Medium severity linux kernel vulnerability
Last updated 24 July 2024
Other sources
The adjustbranches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions.
— Launchpad
When ctx access is used, the kernel often needs to expand/rewrite instructions, so after that patching, branch offsets have to be adjusted for both forward and backward jumps in the new eBPF program, but for backward jumps it fails to account the delta. Meaning, for example, if the expansion happens exactly on the insn that sits at the jump target, it doesn't fix up the back jump offset.
Upstream report and fix:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1b14d27ed0965838350f1377ff97c93ee383492
External reference:
http://seclists.org/oss-sec/2016/q1/330
CVE assignment:
http://seclists.org/oss-sec/2016/q1/333
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-2383.
What is the severity of CVE-2016-2383?
The severity of CVE-2016-2383 is low.
Which software versions are affected by CVE-2016-2383?
The Linux kernel versions before 4.5 are affected by CVE-2016-2383.
How can local users exploit CVE-2016-2383?
Local users can exploit CVE-2016-2383 by creating a packet filter and loading crafted BPF instructions to obtain sensitive information from kernel memory.
Are there any references available for CVE-2016-2383?
Yes, you can find references for CVE-2016-2383 at the following links: [Reference 1](http://www.openwall.com/lists/oss-security/2016/02/14/1), [Reference 2](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a1b14d27ed0965838350f1377ff97c93ee383492), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi?id=1308452).