CVE-2016-4794: Use After Free
Last updated 24 July 2024
Other sources
Use after free vulnerability was found in percpu using previously allocated memory in bpf. First allocpercpugfp() is called, then the memory is freed with freepercpu() which triggers async pcpubalancework and then pcpuextendareamap is hitting use-after-free.
CVE request (contains reproducer): http://seclists.org/oss-sec/2016/q2/332
1: percpu: fix synchronization between chunk->mapextendwork and chunk destruction ( https://www.mail-archive.com/netdev@vger.kernel.org/msg111820.html )
2: percpu: fix synchronization between synchronous map extension and chunk destruction ( https://www.mail-archive.com/netdev@vger.kernel.org/msg111747.html )
— Red Hat
Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibly have unspecified other impact via crafted use of the mmap and bpf system calls.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-4794.
What is the severity of CVE-2016-4794?
The severity of CVE-2016-4794 is critical, with a severity value of 9.
What is the affected software for CVE-2016-4794?
The affected software for CVE-2016-4794 includes Google Android, Linux (Ubuntu), Linux ARMADA XP, and Linux AWS, among others.
How can this vulnerability be exploited?
This vulnerability can be exploited by local users to cause a denial of service (BUG) or have other unspecified impacts through crafted use of the mmap and bpf system calls.
Are there any references for CVE-2016-4794?
Yes, there are references available for CVE-2016-4794. You can find them at the following links: http://seclists.org/oss-sec/2016/q2/332, https://www.mail-archive.com/netdev@vger.kernel.org/msg111820.html, and https://www.mail-archive.com/netdev@vger.kernel.org/msg111747.html.