CVE-2016-6187

The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 4.6.5 does not validate the buffer size, which allows local users to gain privileges by triggering an AppArmor setprocattr hook.

CVSS v3.0 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=30a46a4647fd1df9cf52e43bf467f0d9265096ca	Issue Tracking Patch
http://www.openwall.com/lists/oss-security/2016/07/09/2	Mailing List Third Party Advisory
http://marc.info/?l=linux-kernel&m=146793642811929&w=2	Third Party Advisory
https://github.com/torvalds/linux/commit/30a46a4647fd1df9cf52e43bf467f0d9265096ca	Issue Tracking Patch
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.5	Release Notes
https://bugzilla.redhat.com/show_bug.cgi?id=1354383	Issue Tracking
http://www.securityfocus.com/bid/91696	Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Information

Published : 2016-08-06 13:59

Updated : 2023-01-17 13:15

NVD link : CVE-2016-6187

Mitre link : CVE-2016-6187

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Advertisement

Products Affected

linux

linux_kernel

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=30a46a4647fd1df9cf52e43bf467f0d9265096ca", "name": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=30a46a4647fd1df9cf52e43bf467f0d9265096ca", "tags": ["Issue Tracking", "Patch"], "refsource": "CONFIRM"}, {"url": "http://www.openwall.com/lists/oss-security/2016/07/09/2", "name": "[oss-security] 20160709 Re: CVE request: apparmor: oops in apparmor_setprocattr()", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://marc.info/?l=linux-kernel&m=146793642811929&w=2", "name": "[linux-kernel] 20160708 [GIT PULL] Fix for AppArmor oops in apparmor_setprocattr()", "tags": ["Third Party Advisory"], "refsource": "MLIST"}, {"url": "https://github.com/torvalds/linux/commit/30a46a4647fd1df9cf52e43bf467f0d9265096ca", "name": "https://github.com/torvalds/linux/commit/30a46a4647fd1df9cf52e43bf467f0d9265096ca", "tags": ["Issue Tracking", "Patch"], "refsource": "CONFIRM"}, {"url": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.5", "name": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.5", "tags": ["Release Notes"], "refsource": "CONFIRM"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1354383", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1354383", "tags": ["Issue Tracking"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/91696", "name": "91696", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The apparmor_setprocattr function in security/apparmor/lsm.c in the Linux kernel before 4.6.5 does not validate the buffer size, which allows local users to gain privileges by triggering an AppArmor setprocattr hook."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}, {"lang": "en", "value": "CWE-119"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-6187", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}}, "publishedDate": "2016-08-06T20:59Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "4.6.5", "versionStartIncluding": "4.5"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-01-17T21:15Z"}