CVE-2016-5828: Input Validation
A vulnerability in the handling of Transactional Memory on powerpc systems was found. An unprivileged local user can crash the kernel by starting a transaction, suspending it, and then calling any of the exec() class system calls.
Patch:
https://patchwork.ozlabs.org/patch/636776/
Test case:
https://patchwork.ozlabs.org/patch/636774/
CVE request:
http://seclists.org/oss-sec/2016/q2/595
Other sources
The startthread function in arch/powerpc/kernel/process.c in the Linux kernel through 4.6.3 on powerpc platforms mishandles transactional state, which allows local users to cause a denial of service (invalid process state or TM Bad Thing exception, and system crash) or possibly have unspecified other impact by starting and suspending a transaction before an exec system call.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-5828?
CVE-2016-5828 is a vulnerability in the Linux kernel that affects powerpc platforms and can lead to denial of service or system crash.
How severe is CVE-2016-5828?
CVE-2016-5828 has a severity level of medium.
Which platforms are affected by CVE-2016-5828?
CVE-2016-5828 affects powerpc platforms.
How can CVE-2016-5828 be fixed?
To fix CVE-2016-5828, update the Linux kernel to version 4.7 or higher.
Where can I find more information about CVE-2016-5828?
More information about CVE-2016-5828 can be found at the following references: [link1], [link2], [link3].