CVE-2016-9178

2016-11-2700:00:00

ubuntu.com

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

40.0%

JSON

The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux
kernel before 4.7.5 does not initialize a certain integer variable, which
allows local users to obtain sensitive information from kernel stack memory
by triggering failure of a get_user_ex call.

Notes

Author	Note
sbeattie	the fix for this introduces CVE-2016-9644. NOTE: This is only an issue if 1c109fabbd51863475cd12ac206bdd249aee35af (added in 4.8) is backported without also backporting 548acf19234dbda5a52d5a8e7e205af46e9da840 (added in 4.6). However, the first attempt at backporting 548acf19234dbda5a52d5a8e7e205af46e9da840 was pulled shortly thereafter. The git commit for xenial is 1f4da631f0159d77908edb10f15e84642980cf16.

Author

Note

sbeattie

the fix for this introduces CVE-2016-9644. NOTE: This is only an issue if 1c109fabbd51863475cd12ac206bdd249aee35af (added in 4.8) is backported without also backporting 548acf19234dbda5a52d5a8e7e205af46e9da840 (added in 4.6). However, the first attempt at backporting 548acf19234dbda5a52d5a8e7e205af46e9da840 was pulled shortly thereafter. The git commit for xenial is 1f4da631f0159d77908edb10f15e84642980cf16.

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchlinux< 3.13.0-132.181UNKNOWN
ubuntu16.04noarchlinux< 4.4.0-47.68UNKNOWN
ubuntu14.04noarchlinux-lts-xenial< 4.4.0-47.68~14.04.1UNKNOWN
ubuntu16.04noarchlinux-raspi2< 4.4.0-1038.45UNKNOWN
ubuntu16.04noarchlinux-snapdragon< 4.4.0-1035.39UNKNOWN
ubuntu16.10noarchlinux-snapdragon< 4.4.0-1035.39UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	linux	< 3.13.0-132.181	UNKNOWN
ubuntu	16.04	noarch	linux	< 4.4.0-47.68	UNKNOWN
ubuntu	14.04	noarch	linux-lts-xenial	< 4.4.0-47.68~14.04.1	UNKNOWN
ubuntu	16.04	noarch	linux-raspi2	< 4.4.0-1038.45	UNKNOWN
ubuntu	16.04	noarch	linux-snapdragon	< 4.4.0-1035.39	UNKNOWN
ubuntu	16.10	noarch	linux-snapdragon	< 4.4.0-1035.39	UNKNOWN