CVE-2016-4565: High severity Linux Linux kernel vulnerability
It was reported that drivers/infiniband stack uses write() as a replacement for bi-directional ioctl(), which is not safe. There are ways to trigger write calls that result in the return structure that is normally written to user space being shunted off to user specified kernel memory instead.
A local unprivileged user on a system with rdmaucm module loaded could use this flaw to escalate their privileges.
Upstream patch:
https://git.kernel.org/linus/e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q2/269 http://seclists.org/oss-sec/2016/q2/274
Other sources
The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to cause a denial of service (kernel memory write operation) or possibly have unspecified other impact via a uAPI interface.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.135-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.27-1 - Configuration
Unload the rdma_ucm kernel module and blacklist it to prevent it from being loaded until the system kernel is updated to a fixed version.
kernel module rdma_ucm loaded = disabled/blacklisted
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-4565.
What is the affected software?
The affected software is the InfiniBand (aka IB) stack in the Linux kernel before 4.5.3.
What is the severity of CVE-2016-4565?
The severity of CVE-2016-4565 is high.
How can local users exploit this vulnerability?
Local users can exploit this vulnerability by causing a denial of service (kernel memory write operation) or possibly having unspecified other impact via a uAPI interface.
How can I fix CVE-2016-4565?
To fix CVE-2016-4565, update the Linux kernel to version 4.5.3 or later.