CVE-2016-3672

HIGH
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits.

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b8addf891de8a00e4d39fc32f93f7c5eb8feceb

http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-dis

http://hmarco.org/bugs/CVE-2016-3672-Unlimiting-the-stack-not-longer-disables-ASLR.html

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182524.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html

http://seclists.org/fulldisclosure/2016/Apr/26

http://www.debian.org/security/2016/dsa-3607

http://www.securityfocus.com/archive/1/537996/100/0/threaded

http://www.securityfocus.com/bid/85884

http://www.securitytracker.com/id/1035506

http://www.ubuntu.com/usn/USN-2989-1

http://www.ubuntu.com/usn/USN-2996-1

http://www.ubuntu.com/usn/USN-2997-1

http://www.ubuntu.com/usn/USN-2998-1

http://www.ubuntu.com/usn/USN-3000-1

http://www.ubuntu.com/usn/USN-3001-1

http://www.ubuntu.com/usn/USN-3002-1

http://www.ubuntu.com/usn/USN-3003-1

http://www.ubuntu.com/usn/USN-3004-1

https://access.redhat.com/errata/RHSA-2018:0676

https://access.redhat.com/errata/RHSA-2018:1062

https://bugzilla.redhat.com/show_bug.cgi?id=1324749

https://github.com/torvalds/linux/commit/8b8addf891de8a00e4d39fc32f93f7c5eb8feceb

https://www.exploit-db.com/exploits/39669/

Details

Source: MITRE

Published: 2016-04-27

Updated: 2018-10-09

Type: CWE-254

Risk Information

CVSS v2

Base Score: 4.6

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 3.9

Severity: MEDIUM

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.8

Severity: HIGH

Tenable Plugins

View all (41 total)

IDNameProductFamilySeverity
127281NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel-rt Multiple Vulnerabilities (NS-SA-2019-0074)NessusNewStart CGSL Local Security Checks
critical
127272NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2019-0070)NessusNewStart CGSL Local Security Checks
critical
124837EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1516)NessusHuawei Local Security Checks
critical
124816EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1492)NessusHuawei Local Security Checks
critical
109449Scientific Linux Security Update : kernel on SL7.x x86_64 (20180410) (Meltdown)NessusScientific Linux Local Security Checks
critical
109380CentOS 7 : kernel (CESA-2018:1062)NessusCentOS Local Security Checks
critical
109113Oracle Linux 7 : kernel (ELSA-2018-1062)NessusOracle Linux Local Security Checks
critical
108997RHEL 7 : kernel (RHSA-2018:1062)NessusRed Hat Local Security Checks
critical
108984RHEL 7 : kernel-rt (RHSA-2018:0676)NessusRed Hat Local Security Checks
critical
100238OracleVM 3.2 : Unbreakable / etc (OVMSA-2017-0106)NessusOracleVM Local Security Checks
critical
100235Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2017-3567)NessusOracle Linux Local Security Checks
critical
99848EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1001)NessusHuawei Local Security Checks
critical
99164OracleVM 3.2 : Unbreakable / etc (OVMSA-2017-0058)NessusOracleVM Local Security Checks
high
99163OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)NessusOracleVM Local Security Checks
critical
99162OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0056)NessusOracleVM Local Security Checks
critical
99161Oracle Linux 6 : Unbreakable Enterprise kernel (ELSA-2017-3535)NessusOracle Linux Local Security Checks
high
99160Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3534)NessusOracle Linux Local Security Checks
high
99159Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3533)NessusOracle Linux Local Security Checks
critical
93299SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:2105-1)NessusSuSE Local Security Checks
high
93216openSUSE Security Update : the Linux Kernel (openSUSE-2016-1029)NessusSuSE Local Security Checks
high
93165SUSE SLED12 / SLES12 Security Update : kernel (SUSE-SU-2016:1690-1)NessusSuSE Local Security Checks
high
93104openSUSE Security Update : the Linux Kernel (openSUSE-2016-1015)NessusSuSE Local Security Checks
critical
91886Debian DSA-3607-1 : linux - security updateNessusDebian Local Security Checks
critical
91736openSUSE Security Update : the Linux Kernel (openSUSE-2016-753)NessusSuSE Local Security Checks
critical
91687Debian DLA-516-1 : linux security updateNessusDebian Local Security Checks
critical
91566Ubuntu 15.10 : linux-raspi2 vulnerabilities (USN-3004-1)NessusUbuntu Local Security Checks
critical
91565Ubuntu 15.10 : linux vulnerabilities (USN-3003-1)NessusUbuntu Local Security Checks
critical
91564Ubuntu 14.04 LTS : linux-lts-wily vulnerabilities (USN-3002-1)NessusUbuntu Local Security Checks
critical
91563Ubuntu 14.04 LTS : linux-lts-vivid vulnerabilities (USN-3001-1)NessusUbuntu Local Security Checks
critical
91562Ubuntu 14.04 LTS : linux-lts-utopic vulnerabilities (USN-3000-1)NessusUbuntu Local Security Checks
critical
91560Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2998-1)NessusUbuntu Local Security Checks
critical
91559Ubuntu 12.04 LTS : linux vulnerabilities (USN-2996-1)NessusUbuntu Local Security Checks
critical
91425Ubuntu 14.04 LTS : linux vulnerabilities (USN-2989-1)NessusUbuntu Local Security Checks
critical
91085Ubuntu 16.04 LTS : linux-snapdragon vulnerability (USN-2965-4)NessusUbuntu Local Security Checks
critical
91084Ubuntu 16.04 LTS : linux-raspi2 vulnerabilities (USN-2965-3)NessusUbuntu Local Security Checks
critical
91083Ubuntu 14.04 LTS : linux-lts-xenial vulnerabilities (USN-2965-2)NessusUbuntu Local Security Checks
critical
91082Ubuntu 16.04 LTS : linux vulnerabilities (USN-2965-1)NessusUbuntu Local Security Checks
critical
90952Fedora 22 : kernel-4.4.8-200.fc22 (2016-373c063e79)NessusFedora Local Security Checks
critical
90778Amazon Linux AMI : kernel (ALAS-2016-694)NessusAmazon Linux Local Security Checks
critical
90656Fedora 23 : kernel-4.4.7-300.fc23 (2016-8e858f96b8)NessusFedora Local Security Checks
high
90653Fedora 24 : kernel-4.5.1-300.fc24 (2016-76706f51a7)NessusFedora Local Security Checks
high