CVE-2016-9576: Use After Free
It was found that the blkrqmapuseriov() function in the Linux kernel's block device implementation did not properly restrict the type of iterator, which could allow a local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.
Other sources
The blkrqmapuseriov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
Use-after-free vulnerability in SCSI generic device interface has been reported which allows kernel memory read/write when having access to /dev/sg SCSI generic devices. This issue affects versions of Linux down to 2.6. This was assigned CVE-2016-9576.
Initial message:
https://www.spinics.net/lists/linux-scsi/msg102232.html
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0ac402cfcdc904f9772e1762b3fda112dcc56a0
Oss-security post:
http://seclists.org/oss-sec/2016/q4/644
Later an additional fix was developed, it was assigned CVE-2016-10088, see:
https://bugzilla.redhat.com/showbug.cgi?id=1412210
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
Who is exposed to this issue?
Systems running affected Linux kernel versions with local users able to access /dev/sg* SCSI generic devices are exposed. The issue affects Linux kernels down to version 2.6 and kernels before 4.8.14.
What access does an attacker need?
An attacker needs local access and write access to a /dev/sg device. No user interaction is required.
What could exploitation allow?
Exploitation may allow reading from or writing to arbitrary kernel memory locations. It may also cause a denial of service through a use-after-free condition.
What should be done if patching cannot happen immediately?
Restrict local users' access, particularly write access, to /dev/sg* SCSI generic devices until a patched kernel can be deployed.
How can I determine whether a system is affected?
Check the running kernel version and whether local users can access /dev/sg* devices. Kernels before 4.8.14 are identified as affected in the provided information.