CVE-2016-4805: Use After Free
A use after free vulnerability was found in pppunregisterchannel function. This is triggered when network namespace is removed while pppasync channel is still registered in it and pppunregisterchannel() tries to access its per-netns data in the defunct namespace.
An attacker who could control this memory that is being used in the defunct namespace could create a denial of service by spinlocking a CPU.
An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89
CVE request:
http://seclists.org/oss-sec/2016/q2/319
Other sources
Use-after-free vulnerability in drivers/net/ppp/pppgeneric.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the pppregisternetchannel and pppunregisterchannel functions.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this use-after-free vulnerability?
CVE-2016-4805
What is the severity level of CVE-2016-4805?
The severity level of CVE-2016-4805 is low.
How can the use-after-free vulnerability in Linux kernel before 4.5.2 impact my system?
The use-after-free vulnerability can cause a denial of service (memory corruption and system crash) or possibly have other unspecified impacts.
Is there a fix available for CVE-2016-4805?
Yes, upgrading to Linux kernel version 4.5.2 or later can fix the vulnerability.
Where can I find more information about CVE-2016-4805?
You can find more information about CVE-2016-4805 in the references: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89, http://seclists.org/oss-sec/2016/q2/319, https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1335804.