CVE-2016-5243: Infoleak
A vulnerability was found in the Linux kernel. There is a char array of size 60 in function tipcnlcompatlinkdump of file net/tipc/netlinkcompat.c, linkinfo.str. Memory after the NULL byte is not initialized. Sending the whole object out can cause a leak of sensitive info in kernel stack.
Upstream bug:
https://patchwork.ozlabs.org/patch/629100/
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=5d2be1422e02ccd697ccfcd45c85b4a26e6178e2
Other sources
The tipcnlcompatlinkdump function in net/tipc/netlinkcompat.c in the Linux kernel through 4.6.3 does not properly copy a certain string, which allows local users to obtain sensitive information from kernel stack memory by reading a Netlink message.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 3.13.0-93.140 - Upgrade
Upgrade
ubuntu/linux-lts-vividto a version that resolves this vulnerability.Fixed in 3.19.0-66.74~14.04.1 - Upgrade
Upgrade
ubuntu/linux-lts-xenialto a version that resolves this vulnerability.Fixed in 4.4.0-34.53~14.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 4.4.0-34.53 - Upgrade
Upgrade
ubuntu/linux-raspi2to a version that resolves this vulnerability.Fixed in 4.4.0-1019.25 - Upgrade
Upgrade
ubuntu/linux-snapdragonto a version that resolves this vulnerability.Fixed in 4.4.0-1022.25
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2016-5243.
What is the severity of CVE-2016-5243?
The severity of CVE-2016-5243 is low.
What software versions are affected by CVE-2016-5243?
The software versions affected by CVE-2016-5243 include Linux kernel versions through 4.6.3.
How can local users exploit CVE-2016-5243?
Local users can exploit CVE-2016-5243 by reading a Netlink message to obtain sensitive information from kernel stack memory.
Where can I find more information about CVE-2016-5243?
You can find more information about CVE-2016-5243 in the references provided: http://www.openwall.com/lists/oss-security/2016/06/03/4, http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5d2be1422e02ccd697ccfcd45c85b4a26e6178e2, https://bugzilla.redhat.com/show_bug.cgi?id=1343335.