Lucene search

K
ubuntucveUbuntu.comUB:CVE-2016-10088
HistoryDec 30, 2016 - 12:00 a.m.

CVE-2016-10088

2016-12-3000:00:00
ubuntu.com
ubuntu.com
30

0.0004 Low

EPSS

Percentile

5.2%

The sg implementation in the Linux kernel through 4.9 does not properly
restrict write operations in situations where the KERNEL_DS option is set,
which allows local users to read or write to arbitrary kernel memory
locations or cause a denial of service (use-after-free) by leveraging
access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c.
NOTE: this vulnerability exists because of an incomplete fix for
CVE-2016-9576.

Notes

Author Note
jdstrand android kernels (flo, goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 14.10 and earlier preview kernels linux-lts-saucy no longer receives official support linux-lts-quantal no longer receives official support
sbeattie attack requires access to /dev/sg or other block scsi devices.
Rows per page:
1-10 of 111