CVE-2016-6197: Input Validation
fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with unlink and rename system-call processing, which allows local users to cause a denial of service (system crash) via a rename system call that specifies a self-hardlink.
Other sources
It was found that the unlink and rename functionality in overlayfs did not verify the upper dentry for staleness. A local, unprivileged user could use the rename syscall on overlayfs on top of xfs to crash the system.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=11f3710417d026ea2f4fcf362d866342c5274185
CVE assignment:
http://seclists.org/oss-sec/2016/q3/42
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-6197.
What is the severity of CVE-2016-6197?
The severity of CVE-2016-6197 is medium.
Which Linux kernel versions are affected by CVE-2016-6197?
Linux kernel versions before 4.6 are affected by CVE-2016-6197.
How can local users exploit CVE-2016-6197?
Local users can exploit CVE-2016-6197 by using a rename system call that triggers a denial of service, causing a system crash.
Is there a fix available for CVE-2016-6197?
Yes, a fix for CVE-2016-6197 is available in Linux kernel version 4.6 and later.