Lucene search

K
ubuntucveUbuntu.comUB:CVE-2016-9178
HistoryNov 27, 2016 - 12:00 a.m.

CVE-2016-9178

2016-11-2700:00:00
ubuntu.com
ubuntu.com
6

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%

The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux
kernel before 4.7.5 does not initialize a certain integer variable, which
allows local users to obtain sensitive information from kernel stack memory
by triggering failure of a get_user_ex call.

Notes

Author Note
sbeattie the fix for this introduces CVE-2016-9644. NOTE: This is only an issue if 1c109fabbd51863475cd12ac206bdd249aee35af (added in 4.8) is backported without also backporting 548acf19234dbda5a52d5a8e7e205af46e9da840 (added in 4.6). However, the first attempt at backporting 548acf19234dbda5a52d5a8e7e205af46e9da840 was pulled shortly thereafter. The git commit for xenial is 1f4da631f0159d77908edb10f15e84642980cf16.
OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchlinux< 3.13.0-132.181UNKNOWN
ubuntu16.04noarchlinux< 4.4.0-47.68UNKNOWN
ubuntu14.04noarchlinux-lts-xenial< 4.4.0-47.68~14.04.1UNKNOWN
ubuntu16.04noarchlinux-raspi2< 4.4.0-1038.45UNKNOWN
ubuntu16.04noarchlinux-snapdragon< 4.4.0-1035.39UNKNOWN
ubuntu16.10noarchlinux-snapdragon< 4.4.0-1035.39UNKNOWN

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.3%