CVE-2016-4998: Buffer Overflow
An out-of-bounds heap memory access, leading to a Denial of Service or possibly heap disclosure or further impact was found in setsockopt(). The particular setsockopt() call is normally restricted to root, however some processes with capsysadmin may also be able to trigger this flaw.
Upstream fixes
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d04 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb088 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bdf533de6968
Discussion on oss-sec: http://www.openwall.com/lists/oss-security/2016/06/24/5
Other sources
The IPTSOSETREPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2016-4998?
CVE-2016-4998 is a vulnerability in the Linux kernel that allows local users to cause a denial of service or obtain sensitive information from kernel heap memory.
How does CVE-2016-4998 impact the Linux kernel?
CVE-2016-4998 can result in an out-of-bounds read, leading to a denial of service or potential information disclosure.
Which versions of the Linux kernel are affected by CVE-2016-4998?
CVE-2016-4998 affects Linux kernel versions before 4.6.
How can the vulnerability in CVE-2016-4998 be fixed?
To fix the vulnerability in CVE-2016-4998, update to Linux kernel version 4.6 or later.
Where can I find more information about CVE-2016-4998?
You can find more information about CVE-2016-4998 at the following references: [SecurityTracker](http://www.securitytracker.com/id/1036171), [SecurityFocus](http://www.securityfocus.com/bid/91451), [Debian Security Advisory](http://www.debian.org/security/2016/dsa-3607).