6.2med
CVE-2016-9040
An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.2
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 41%
Public exploits
0
none known
Summary
An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32 bit model. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploit this will result in memory exhaustion, resulting in a full system denial of service.
Exploit prediction (EPSS)
0.47% probability of exploitation in the next 30 days, higher than 41% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.2 | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.0 | 6.2 | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 4.9 | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Affected products
- Joyent SmartOS
Classification
- Weakness
- CWE-400 Uncontrolled Resource Consumption
References
- talosintelligence.com /vulnerability_reports/TALOS-2016-0258 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2016-9040
- NVD: CVE-2016-9040
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.