CVE-2016-4557: Use After Free
A use after free vulnerability was found in kernel which allows privilege escalation for users with a local account on the system. When a program was loaded with a bpf program an attacker could exploit this to gain root privileges by an unprivileged user.
When bpf(BPFPROGLOAD, ...) was invoked with a BPF program whose bytecode references a non-map file descriptor as a map file descriptor, the error handling code called fdput() twice instead of once (in bpfmapget() and in replacemapfdwithmapptr()). If the file descriptor table of the current task is shared, this causes fcount to be decremented too much, allowing the struct file to be freed while it is still in use (use-after-free).
Bug was introduced in 0246e64d9a5f and is exploitable since 1be7f75d1668 without the need for CAPSYSADMIN capability.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7
Original report:
https://bugs.chromium.org/p/project-zero/issues/detail?id=808
CVE request:
http://seclists.org/oss-sec/2016/q2/263
Other sources
The replacemapfdwithmapptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allows local users to gain privileges or cause a denial of service (use-after-free) via crafted BPF instructions that reference an incorrect file descriptor.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-4557?
CVE-2016-4557 is a vulnerability in the Linux kernel that allows local users to gain privileges or cause a denial of service.
How severe is CVE-2016-4557?
CVE-2016-4557 has a severity value of 7, which is considered high.
How can I fix CVE-2016-4557?
To fix CVE-2016-4557, update your Linux kernel to version 4.6 or higher.
Where can I find more information about CVE-2016-4557?
You can find more information about CVE-2016-4557 at the following references: [Link 1](http://www.openwall.com/lists/oss-security/2016/05/06/4), [Link 2](https://bugs.chromium.org/p/project-zero/issues/detail?id=808), [Link 3](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8358b02bf67d3a5d8a825070e1aa73f25fb2e4c7).
What is the Common Weakness Enumeration (CWE) for CVE-2016-4557?
The Common Weakness Enumeration (CWE) for CVE-2016-4557 is CWE-416 (Use After Free).