CVE-2016-4951

Published: 23 May 2016

The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a dumpit operation.

From the Ubuntu security team

Baozeng Ding discovered that the Transparent Inter-process Communication (TIPC) implementation in the Linux kernel did not verify socket existence before use in some situations. A local attacker could use this to cause a denial of service (system crash).

Priority

Low

CVSS 3 base score: 7.8

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4951
• http://lists.openwall.net/netdev/2016/05/14/28
• http://www.openwall.com/lists/oss-security/2016/05/21/2
• https://ubuntu.com/security/notices/USN-3016-1
• https://ubuntu.com/security/notices/USN-3016-2
• https://ubuntu.com/security/notices/USN-3017-1
• https://ubuntu.com/security/notices/USN-3017-3
• https://ubuntu.com/security/notices/USN-3016-3
• https://ubuntu.com/security/notices/USN-3016-4
• https://ubuntu.com/security/notices/USN-3017-2
• https://ubuntu.com/security/notices/USN-3020-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1585365