vulnwire
7.8high

CVE-2016-8655in critical feed3 exploits

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of serv…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
11.1%
percentile 96%
Public exploits
3
Exploit-DB

Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW capability to change a socket version, related to the packet_set_ring and packet_setsockopt functions.

Exploit prediction (EPSS)

11.13% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

Exploits and detections

  • EDB-47170 Linux Kernel 4.4.0-21 < 4.4.0-51 (Ubuntu 14.04/16.04 x64) - 'AF_PACKET' Race Condition Privilege Escalation · local · 2018-12-29
  • EDB-44696 Linux 4.4.0 < 4.4.0-53 - 'AF_PACKET chocobo_root' Local Privilege Escalation (Metasploit) · local · 2018-05-22
  • EDB-40871 Linux Kernel 4.4.0 (Ubuntu 14.04/16.04 x86-64) - 'AF_PACKET' Race Condition Privilege Escalation · local · 2016-12-06

CVSS scores

Assigned byVersionScoreVector
NVD3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
  • CWE-416 Use After Free
Technology feeds
Linux kernel (RSS, critical only)

References

  • ubuntu.com /usn/USN-3151-3 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00044.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • github.com /torvalds/linux/commit/84ac7260236a49c79eede91617700174c2c19b0c · x_refsource_CONFIRM, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00077.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00067.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • ubuntu.com /usn/USN-3150-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • ubuntu.com /usn/USN-3149-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • securityfocus.com /bid/94692 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1037968 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • ubuntu.com /usn/USN-3150-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00056.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00073.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • rhn.redhat.com /errata/RHSA-2017-0402.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • ubuntu.com /usn/USN-3151-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • rhn.redhat.com /errata/RHSA-2017-0387.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19 · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/40871/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • ubuntu.com /usn/USN-3149-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=1400019 · x_refsource_CONFIRM, x_transferred
  • exploit-db.com /exploits/44696/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00087.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • ubuntu.com /usn/USN-3151-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00070.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • packetstormsecurity.com /files/140063/Linux-Kernel-4.4.0-AF_PACKET-Race-Condition-Privilege-Escalation.html · x_refsource_MISC, x_transferred
  • openwall.com /lists/oss-security/2016/12/06/1 · mailing-list, x_refsource_MLIST, x_transferred
  • ubuntu.com /usn/USN-3152-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • ubuntu.com /usn/USN-3152-2 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • rhn.redhat.com /errata/RHSA-2017-0386.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securitytracker.com /id/1037403 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • ubuntu.com /usn/USN-3151-4 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00055.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00054.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • source.android.com /security/bulletin/2017-03-01.html · x_refsource_CONFIRM, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00076.html · vendor-advisory, x_refsource_SUSE, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.