Published: 27/04/2016 Updated: 18/01/2018

CVSS v2 Base Score: 4.9 | Impact Score: 6.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 437

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

The Linux kernel prior to 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel

When running as a Xen 64-bit PV guest, user mode processes not supposed to be able to access I/O ports may be granted such permission, potentially resulting in one or more of in-guest privilege escalation, guest crashes (Denial of Service), or in-guest information leaks (CVE-2016-3157) In some cases, the kernel did not correctly fix backward jumps ...

Several security issues were fixed in the kernel ...

USN 2948-1 introduced a regression in the Ubuntu 1410 Linux kernel backported to Ubuntu 1404 LTS ...

Several security issues were fixed in the kernel ...

A resource-exhaustion vulnerability was found in the kernel, where an unprivileged process could allocate and accumulate far more file descriptors than the process' limit A local, unauthenticated user could exploit this flaw by sending file descriptors over a Unix socket and then closing them to keep the process' fd count low, thereby creating ker ...

Ubuntu plugs code exec, DoS Linux kernel holes

The Register • Team Register • 07 Apr 2016

This is kind of a big deal because the mess is in 14.04 LTS, expiry date 2019

Ubuntu has patched four Linux kernel vulnerabilities that allowed for arbitrary code execution and denial of service attacjs. The flaws (CVE-2015-8812, CVE-2016-2085, CVE-2016-2550, CVE-2016-2847) is fixed in Ubuntu 14.04 LTS. Researcher Venkatesh Pottem found a use-after-free vulnerability in the Linux kernel CXGB3 driver which local hackers could use to trigger a crash or execute arbitrary code. Xiaofei Rex Guo reported a second timing side channel vulnerability in the Linux Extended Verificat...

CVE-2016-2550

Vulnerability Summary

Vendor Advisories

Recent Articles

References

Vulmon Search

About

Products

Connect