CVE-2016-7425: Buffer Overflow
A heap-buffer overflow vulnerability was found in the arcmsriopmessagexfer() function in 'drivers/scsi/arcmsr/arcmsrhba.c' file in the Linux kernel through 4.8.2. The function does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service via an ARCMSRMESSAGEWRITEWQBUFFER control code. This can potentially cause kernel heap corruption and arbitrary kernel code execution.
Upstream patch:
http://marc.info/?l=linux-scsi&m=147394713328707&w=2
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7bc2b55a5c030685b399bb65b6baa9ccc3d1f167
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4bd173c30792791a6daca8c64793ec0a4ae8324f
Discussion thread:
http://marc.info/?t=147394719700004&r=1&w=2
References:
http://seclists.org/oss-sec/2016/q3/535
Other sources
The arcmsriopmessagexfer function in drivers/scsi/arcmsr/arcmsrhba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSRMESSAGEWRITEWQBUFFER control code.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2016-7425.
What is the severity level of CVE-2016-7425?
The severity level of CVE-2016-7425 is low.
How does CVE-2016-7425 affect the Linux kernel?
CVE-2016-7425 allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) in the Linux kernel through version 4.8.2.
Which versions of the Linux kernel are affected by CVE-2016-7425?
The Linux kernel versions up to 4.8.2 are affected by CVE-2016-7425.
Where can I find more information about CVE-2016-7425?
You can find more information about CVE-2016-7425 at the following references: [link1], [link2], [link3].