CVE-2016-4470: Medium severity oracle vm server vulnerability
A local user can trigger a flaw in the Linux kernel's handling of key lookups in the keychain subsystem.
The keyrejectandlink() function contains an error in which a key-lookup can fail and in an attempt to cache the failed lookup may attempt to free memory which can still be in use.
This could crash the system or at worse free a memory block which would then be re-used by another kernel mechanism causing a user after free.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1341352
Upstream patch:
https://www.spinics.net/lists/linux-kernel-janitors/msg26069.html
Other sources
The keyrejectandlink function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-4470.
What is the severity of CVE-2016-4470?
The severity of CVE-2016-4470 is high with a severity value of 7.
How does CVE-2016-4470 impact the Linux kernel?
CVE-2016-4470 can cause a denial of service (system crash) in the Linux kernel.
Which Linux kernel versions are affected by CVE-2016-4470?
Linux kernel versions through 4.6.3 are affected by CVE-2016-4470.
How can I fix CVE-2016-4470?
To fix CVE-2016-4470, update your Linux kernel to version 4.7 or later.