CVE-2016-4558

Published: 23 May 2016

The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted application on (1) a system with more than 32 Gb of memory, related to the program reference count or (2) a 1 Tb system, related to the map reference count.

From the Ubuntu security team

Jann Horn discovered that the extended Berkeley Packet Filter (eBPF) implementation in the Linux kernel could overflow reference counters on systems with more than 32GB of physical ram and with RLIMIT_MEMLOCK set to infinite. A local unprivileged attacker could use to create a use-after- free situation, causing a denial of service (system crash) or possibly gain administrative privileges.

Priority

Medium

CVSS 3 base score: 7.0

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

made exploitable by unpriv bpf

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4558
• https://git.kernel.org/linus/92117d8443bc5afacc8d5ba82e541946310f106e
• http://www.openwall.com/lists/oss-security/2016/05/06/7
• https://ubuntu.com/security/notices/USN-3005-1
• https://ubuntu.com/security/notices/USN-3006-1
• https://ubuntu.com/security/notices/USN-3007-1
• NVD
• Launchpad
• Debian