CVE-2016-4997: High severity linux kernel vulnerability
A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module. This action is usually restricted to root-priveledged users but can also be leveraged if the kernel is compiled with CONFIGUSERNS and CONFIGNETNS and the user is granted elevated priveledges.
This flaw was introduced in commit 52e804c6dfaa,
Upstream fixes
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d04 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb088 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bdf533de6968
Discussion on oss-sec: http://www.openwall.com/lists/oss-security/2016/06/24/5
Other sources
The compat IPTSOSETREPLACE and IP6TSOSETREPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4997?
CVE-2016-4997 is considered a high severity vulnerability that allows arbitrary kernel memory alteration.
How do I fix CVE-2016-4997?
To address CVE-2016-4997, it is recommended to update to the patched Linux kernel versions such as 5.10.223-1 or later.
Which systems are affected by CVE-2016-4997?
CVE-2016-4997 affects 32-bit Linux processes running on 64-bit systems across various Linux kernel versions.
What potential impact does CVE-2016-4997 have on systems?
Exploitation of CVE-2016-4997 can lead to unauthorized access and alteration of kernel memory, compromising system integrity.
Is CVE-2016-4997 relevant for all Linux distributions?
CVE-2016-4997 is relevant for several Linux distributions, including Debian, Ubuntu, and SUSE, depending on the kernel version.