CVE-2016-10088

Published: 30 December 2016

The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.

From the Ubuntu Security Team

It was discovered that the generic SCSI block layer in the Linux kernel did not properly restrict write operations in certain situations. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

attack requires access to /dev/sg or other block scsi devices.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10088
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=128394eff343fc6d2f32172f03e24829539c5835
• http://www.openwall.com/lists/oss-security/2016/12/30/1
• https://github.com/torvalds/linux/commit/128394eff343fc6d2f32172f03e24829539c5835
• https://ubuntu.com/security/notices/USN-3208-1
• https://ubuntu.com/security/notices/USN-3208-2
• https://ubuntu.com/security/notices/USN-3209-1
• https://ubuntu.com/security/notices/USN-3360-1
• https://ubuntu.com/security/notices/USN-3360-2
• NVD
• Launchpad
• Debian