CVE-2016-5244: Infoleak
A vulnerability was found in the Linux kernel in function rdsincinfocopy of file net/rds/recv.c. The last field "flags" of object "minfo" is not initialized. Copying this object out may leak kernel stack data. Assign 0 to it to avoid leak.
Upstream bug:
https://patchwork.ozlabs.org/patch/629110/
Upstream fix:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=4116def2337991b39919f3b448326e21c40e0dbb
Other sources
The rdsincinfocopy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-5244?
CVE-2016-5244 is a vulnerability in the Linux kernel that allows remote attackers to obtain sensitive information from kernel stack memory.
How severe is CVE-2016-5244?
CVE-2016-5244 is classified as a low severity vulnerability.
Which versions of the Linux kernel are affected by CVE-2016-5244?
Linux kernel versions through 4.6.3 are affected by CVE-2016-5244.
How do I fix CVE-2016-5244?
To fix CVE-2016-5244, update your Linux kernel to version 4.6.4 or higher.
Where can I find more information about CVE-2016-5244?
You can find more information about CVE-2016-5244 in the references provided: http://www.openwall.com/lists/oss-security/2016/06/03/5, http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4116def2337991b39919f3b448326e21c40e0dbb, https://bugzilla.redhat.com/show_bug.cgi?id=1343337