CVE-2016-8650: Input Validation
A flaw was found in the Linux kernel key management subsystem in which a local attacker could crash the kernel or corrupt the stack and additional memory (denial of service) by supplying a specially crafted RSA key. This flaw panics the machine during the verification of the RSA key and is key-payload independant.
This vulnerably can be triggered by any unprivileged user with a local shell account.
References:
http://seclists.org/fulldisclosure/2016/Nov/76
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1343162
Other sources
The mpipowm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service (stack memory corruption and panic) via an addkey system call for an RSA key with a zero exponent.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2016-8650.
What is the severity of CVE-2016-8650?
CVE-2016-8650 has a severity value of 7, which is high.
How does CVE-2016-8650 affect the Linux kernel?
CVE-2016-8650 can cause a denial of service (stack memory corruption and panic) in the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2016-8650?
The Linux kernel versions through 4.8.11 are affected by CVE-2016-8650.
How can I fix CVE-2016-8650?
To fix CVE-2016-8650, you should update your Linux kernel to version 4.8.12 or higher.