CVE-2016-3070: Null Pointer Dereference

Q: Who can exploit this issue?

A local user can trigger the flaw. The provided vector requires local access and low privileges, with no user interaction required.

Q: What conditions are needed to trigger the crash?

The issue is triggered when moving a page mapped by an AIO ring buffer to another NUMA node. This can cause a NULL pointer dereference in trace_writeback_dirty_page() because aio_fs_backing_dev_info.dev is zero.

Q: What is the impact of successful exploitation?

Successful triggering can crash the system, causing a denial of service. The description also notes the possibility of other unspecified impact.

Q: Which kernel versions are affected?

The affected implementation is described as Linux kernel versions before 4.4. The listed affected software includes Linux kernel packages from Ubuntu, Debian, and Red Hat, including realtime kernel variants.

Published Feb 16, 2016

Updated

A security flaw was found in the Linux kernel that an attempt to move page mapped by AIO ring buffer to the other node triggers NULL pointer dereference at tracewritebackdirtypage(), because aiofsbackingdevinfo.dev is 0.

Other sources

It was reported that attempt to move page mapped by aio ring buffer to other node triggers NULL pointer dereference at tracewritebackdirtypage(), because aiofsbackingdevinfo.dev is 0.

Product bug (contains reproducer):

https://bugzilla.redhat.com/showbug.cgi?id=1306851

Upstream patch:

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=42cb14b110a5698ccf26ce59c4441722605a3743

— Red Hat

The tracewritebackdirtypage implementation in include/trace/events/writeback.h in the Linux kernel before 4.4 improperly interacts with mm/migrate.c, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by triggering a certain page move.

Affected Software

29 affected componentsFixes available

redhat/kernel-rt<0:3.10.0-514.rt56.420.el7

0:3.10.0-514.rt56.420.el7

redhat/kernel<0:3.10.0-514.el7

0:3.10.0-514.el7

Debian Debian Linux=8.0

Linux Linux kernel<=4.3.6

debian/linux

6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.3-1

ubuntu/linux<3.13.0-92.139

3.13.0-92.139

ubuntu/linux-lts-utopic<3.16.0-77.99~14.04.1

3.16.0-77.99~14.04.1

ubuntu/linux-lts-vivid<3.19.0-65.73~14.04.1

3.19.0-65.73~14.04.1

ubuntu/linux-lts-wily<4.2.0-42.49~14.04.1

4.2.0-42.49~14.04.1

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-azure-6.11*

ubuntu/linux-gcp-6.11*

ubuntu/linux-hwe-6.11*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/kernel-rt to a version that resolves this vulnerability.
Fixed in 0:3.10.0-514.rt56.420.el7
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:3.10.0-514.el7
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 3.13.0-92.139
Upgrade
Upgrade ubuntu/linux-lts-utopic to a version that resolves this vulnerability.
Fixed in 3.16.0-77.99~14.04.1
Upgrade
Upgrade ubuntu/linux-lts-vivid to a version that resolves this vulnerability.
Fixed in 3.19.0-65.73~14.04.1
Upgrade
Upgrade ubuntu/linux-lts-wily to a version that resolves this vulnerability.
Fixed in 4.2.0-42.49~14.04.1
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Fixed in 4.4

Event History

Feb 16, 2016

Data Sourced

via Red Hat·09:30 AM

DescriptionSeverityAffected Software

May 10, 2016

CVE Published

12:00 AM

May 13, 2016

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Aug 6, 2016

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

Who can exploit this issue?

A local user can trigger the flaw. The provided vector requires local access and low privileges, with no user interaction required.

What conditions are needed to trigger the crash?

The issue is triggered when moving a page mapped by an AIO ring buffer to another NUMA node. This can cause a NULL pointer dereference in trace_writeback_dirty_page() because aio_fs_backing_dev_info.dev is zero.

What is the impact of successful exploitation?

Successful triggering can crash the system, causing a denial of service. The description also notes the possibility of other unspecified impact.

Which kernel versions are affected?

The affected implementation is described as Linux kernel versions before 4.4. The listed affected software includes Linux kernel packages from Ubuntu, Debian, and Red Hat, including realtime kernel variants.

CVE-2016-3070: Null Pointer Dereference

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What conditions are needed to trigger the crash?

What is the impact of successful exploitation?

Which kernel versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What conditions are needed to trigger the crash?

What is the impact of successful exploitation?

Which kernel versions are affected?