SB2016102803 - Red Hat update for kernel
Published: October 28, 2016 Updated: December 15, 2022
Security Bulletin ID
SB2016102803
Severity
Medium
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2016-1583)
The vulnerability allows a local attacker to cause DoS condition and gain elevated privileges on the target system.The weakness exists in the ecryptfs_privileged_open function in fs/ecryptfs/kthread.c due to stack memory consumption. A local attacker can cause the service to crash and gain elevated privileges via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.
2) Privilege escalation (CVE-ID: CVE-2016-5195)
The vulnerability allows a local user to obtain elevated privileges on the target system.The weakness is due to race condition in the kernel memory subsystem in the management of copy-on-write operations on read-only memory mappings that lets attackers to overwrite kernel memory and gain kernel-level privileges.
Successful exploitation of the vulnerability results in gaining of root privileges on the vulnerable system.
Note: the vulnerability was being actively exploited.
Remediation
Install update from vendor's website.