8.4
CVSSv3

CVE-2016-3134

Published: 27/04/2016 Updated: 07/11/2023
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
CVSS v3 Base Score: 8.4 | Impact Score: 5.9 | Exploitability Score: 2.5
VMScore: 725
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

The netfilter subsystem in the Linux kernel up to and including 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

novell suse linux enterprise module for public cloud 12.0

novell suse linux enterprise server 11.0

novell suse linux enterprise server 12.0

novell suse linux enterprise live patching 12.0

novell suse linux enterprise desktop 12.0

novell suse linux enterprise real time extension 12.0

novell suse linux enterprise workstation extension 12.0

novell suse linux enterprise debuginfo 11.0

novell suse linux enterprise software development kit 11.0

novell suse linux enterprise software development kit 12.0

linux linux kernel

Vendor Advisories

Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise MRG 25Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Synopsis Important: kernel-rt security and bug fix update Type/Severity Security Advisory: Important Topic An update for kernel-rt is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks CVE-2015-7515, CVE-2016-2184, CVE-2016-2185, CVE-2016-2186, CVE-2016-2187, CVE-2016-3136, CVE-2016-3137, CVE-2016-3138, CVE-2016-3140 Ralf Spenneberg of OpenSource Sec ...
An integer overflow vulnerability was found in xt_alloc_table_info, which on 32-bit systems can lead to small structure allocation and a copy_from_user based heap corruption (CVE-2016-3135) In the mark_source_chains function (net/ipv4/netfilter/ip_tablesc) it is possible for a user-supplied ipt_entry structure to have a large next_offset field T ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
A security flaw was found in the Linux kernel in the mark_source_chains() function in "net/ipv4/netfilter/ip_tablesc" It is possible for a user-supplied "ipt_entry" structure to have a large "next_offset" field This field is not bounds checked prior to writing to a counter value at the supplied offset ...

Exploits

Source: codegooglecom/p/google-security-research/issues/detail?id=758 A memory corruption vulnerability exists in the IPT_SO_SET_REPLACE ioctl in the netfilter code for iptables support This ioctl is can be triggered by an unprivileged user on PF_INET sockets when unprivileged user namespaces are available (CONFIG_USER_NS=y) Android do ...

References

CWE-119http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.htmlhttps://github.com/torvalds/linux/commit/54d83fc74aa9ec72794373cb47432c5f7fb1a309https://code.google.com/p/google-security-research/issues/detail?id=758http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00022.htmlhttp://www.ubuntu.com/usn/USN-2930-1http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00056.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1317383http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlhttp://www.ubuntu.com/usn/USN-2930-2http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54d83fc74aa9ec72794373cb47432c5f7fb1a309http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1847.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00019.htmlhttp://www.ubuntu.com/usn/USN-3049-1http://rhn.redhat.com/errata/RHSA-2016-1875.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00026.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.htmlhttp://www.ubuntu.com/usn/USN-2930-3http://www.debian.org/security/2016/dsa-3607http://www.securitytracker.com/id/1036763http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00021.htmlhttp://www.ubuntu.com/usn/USN-2929-1http://www.ubuntu.com/usn/USN-2932-1http://www.ubuntu.com/usn/USN-3050-1http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00018.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.htmlhttp://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00014.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1883.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00016.htmlhttp://www.ubuntu.com/usn/USN-2931-1http://www.ubuntu.com/usn/USN-2929-2http://www.securityfocus.com/bid/84305https://access.redhat.com/errata/RHSA-2016:1883https://nvd.nist.govhttps://www.exploit-db.com/exploits/39545/https://usn.ubuntu.com/2931-1/https://www.debian.org/security/./dsa-3607