CVE-2016-0728

Published: 19 January 2016

The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.

From the Ubuntu security team

Yevgeny Pats discovered that the session keyring implementation in the Linux kernel did not properly reference count when joining an existing session keyring. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Priority

High

CVSS 3 base score: 7.8

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0728
• http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
• https://ubuntu.com/security/notices/USN-2872-1
• https://ubuntu.com/security/notices/USN-2872-2
• https://ubuntu.com/security/notices/USN-2872-3
• https://ubuntu.com/security/notices/USN-2871-2
• https://ubuntu.com/security/notices/USN-2871-1
• https://ubuntu.com/security/notices/USN-2873-1
• https://ubuntu.com/security/notices/USN-2870-1
• https://ubuntu.com/security/notices/USN-2870-2
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1534887