CVE-2016-0821

Published: 12 March 2016

The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3, as used in Android 6.0.1 before 2016-03-01, does not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialized list entry, aka Android internal bug 26186802, a different vulnerability than CVE-2015-3636.

From the Ubuntu Security Team

Zach Riggle discovered that the Linux kernel's list poison feature did not take into account the mmap_min_addr value. A local attacker could use this to bypass the kernel's poison-pointer protection mechanism while attempting to exploit an existing kernel vulnerability.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0821
• http://www.openwall.com/lists/oss-security/2015/05/02/6
• http://source.android.com/security/bulletin/2016-03-01.html
• https://ubuntu.com/security/notices/USN-2971-2
• https://ubuntu.com/security/notices/USN-2971-3
• https://ubuntu.com/security/notices/USN-2971-1
• https://ubuntu.com/security/notices/USN-2970-1
• https://ubuntu.com/security/notices/USN-2969-1
• https://ubuntu.com/security/notices/USN-2967-2
• https://ubuntu.com/security/notices/USN-2967-1
• https://ubuntu.com/security/notices/USN-2968-1
• https://ubuntu.com/security/notices/USN-2968-2
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1561389