CVE-2016-9793: Buffer Overflow
A flaw was found in the Linux kernel's implementation of setsockopt for the SO{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAPNETADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative. This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
Other sources
A flaw was found in the Linux kernels implementation of setsockopt for the SO{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAPNETADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
This situation affects SOSNDBUFF and SORCVBUFF similarly as shown in CVE-2012-6704.
Upstream patch:
https://github.com/torvalds/linux/commit/b98b0bc8c431e3ceb4b26b0dfc8db509518fb290
CVE assignment:
http://seclists.org/oss-sec/2016/q4/574
— Red Hat
The socksetsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sksndbuf and skrcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAPNETADMIN capability for a crafted setsockopt system call with the (1) SOSNDBUFFORCE or (2) SORCVBUFFORCE option.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-9793?
CVE-2016-9793 has been rated as a high severity vulnerability due to its potential to cause denial of service and memory corruption.
How do I fix CVE-2016-9793?
To fix CVE-2016-9793, upgrade to a kernel version newer than 4.8.14 or apply the specific patches provided by your Linux distribution.
What systems are affected by CVE-2016-9793?
CVE-2016-9793 affects various versions of the Linux kernel prior to 4.8.14 as well as several specific distributions such as Red Hat and Debian.
What type of vulnerability is CVE-2016-9793?
CVE-2016-9793 is a local denial of service vulnerability that arises from improper handling of socket options in the Linux kernel.
Can CVE-2016-9793 be exploited remotely?
No, CVE-2016-9793 requires local user access to be exploited, making it a local privilege escalation nor denial of service issue.