Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.8
CVSSv3

CVE-2016-1583

Published: 27/06/2016 Updated: 12/09/2023
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 725
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Subscribe to Linux Kernel

Vulnerability Summary

The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel prior to 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

novell suse linux enterprise server 11.0

novell suse linux enterprise server 12.0

novell suse linux enterprise live patching 12.0

novell suse linux enterprise desktop 12.0

novell suse linux enterprise module for public cloud 12

novell suse linux enterprise workstation extension 12.0

novell suse linux enterprise debuginfo 11.0

novell suse linux enterprise software development kit 11.0

novell suse linux enterprise software development kit 12.0

canonical ubuntu linux 15.10

canonical ubuntu linux 14.04

canonical ubuntu linux 16.04

canonical ubuntu linux 12.04

debian debian linux 8.0

Vendor Advisories

Red Hat: Important: kernel security and bug fix update
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) b ...
Red Hat: Important: kernel security and bug fix update
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 67 Extended Update SupportRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerabili ...
Red Hat: Important: kernel security and bug fix update
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel is now available for Red Hat Enterprise Linux 5Red Hat Product Security has rated this update as having a security impact ofImportant A Common Vulnerability Scoring System (CVSS) ba ...
Debian Security Advisories: DSA-3607-1 linux -- security update
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2015-7515, CVE-2016-2184, CVE-2016-2185, CVE-2016-2186, CVE-2016-2187, CVE-2016-3136, CVE-2016-3137, CVE-2016-3138, CVE-2016-3140 Ralf Spenneberg of OpenSource Sec ...
Red Hat: CVE-2016-1583
It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a recursion by mapping /proc/environ An unprivileged, local user could potentially use this flaw to escalate their privileges on the system ...
Ubuntu Security Notice: linux-lts-xenial vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux-raspi2 vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux-lts-vivid vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux-snapdragon vulnerability
The system could be made to crash under certain conditions ...
Ubuntu Security Notice: linux-ti-omap4 vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux-raspi2 vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux-lts-wily vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux vulnerability
The system could be made to crash or run programs as an administrator ...
Ubuntu Security Notice: linux-lts-trusty vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux-lts-utopic vulnerabilities
Several security issues were fixed in the kernel ...
Ubuntu Security Notice: linux vulnerabilities
Several security issues were fixed in the kernel ...

Exploits

Exploit DB: Linux Kernel - 'ecryptfs' '/proc/$pid/environ' Local Privilege Escalation
Source: bugschromiumorg/p/project-zero/issues/detail?id=836 Stacking filesystems, including ecryptfs, protect themselves against deep nesting, which would lead to kernel stack overflow, by tracking the recursion depth of filesystems Eg in ecryptfs, this is implemented in ecryptfs_mount() as follows: s->s_stack_depth = pathdentry ...

References

CWE-119https://github.com/torvalds/linux/commit/2f36db71009304b3f0b95afacd8eba1f9f046b87https://github.com/torvalds/linux/commit/f5364c150aa645b3d7daa21b5c0b9feaa1c9cd6dhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2f36db71009304b3f0b95afacd8eba1f9f046b87https://bugzilla.redhat.com/show_bug.cgi?id=1344721http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f5364c150aa645b3d7daa21b5c0b9feaa1c9cd6dhttps://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.3http://www.openwall.com/lists/oss-security/2016/06/22/1https://bugs.chromium.org/p/project-zero/issues/detail?id=836http://www.openwall.com/lists/oss-security/2016/06/10/8http://www.ubuntu.com/usn/USN-2997-1http://www.ubuntu.com/usn/USN-2996-1http://www.ubuntu.com/usn/USN-3002-1http://www.ubuntu.com/usn/USN-3001-1http://www.ubuntu.com/usn/USN-3004-1http://www.ubuntu.com/usn/USN-3000-1http://www.ubuntu.com/usn/USN-2998-1http://www.ubuntu.com/usn/USN-3003-1https://www.exploit-db.com/exploits/39992/http://packetstormsecurity.com/files/137560/Linux-ecryptfs-Stack-Overflow.htmlhttp://www.ubuntu.com/usn/USN-3005-1http://www.ubuntu.com/usn/USN-3006-1http://www.ubuntu.com/usn/USN-2999-1http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00027.htmlhttp://www.ubuntu.com/usn/USN-3007-1http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00056.htmlhttp://www.ubuntu.com/usn/USN-3008-1http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00014.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00016.htmlhttp://www.debian.org/security/2016/dsa-3607http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.htmlhttp://www.securityfocus.com/bid/91157http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00019.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00018.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00021.htmlhttp://www.securitytracker.com/id/1036763https://access.redhat.com/errata/RHSA-2017:2760http://rhn.redhat.com/errata/RHSA-2016-2766.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2124.htmlhttps://github.com/torvalds/linux/commit/f0fe970df3838c202ef6c07a4c2b36838ef0a88bhttps://nvd.nist.govhttps://access.redhat.com/errata/RHSA-2016:2766https://www.exploit-db.com/exploits/39992/https://usn.ubuntu.com/3005-1/https://www.debian.org/security/./dsa-3607
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook