CVE-2016-4997

high-risk
Published 2016-07-03

The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.

Do I need to act?

~
6.4% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
2 public exploits available
40489, 40435
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (18)

Affected Vendors

Linux Oracle Debian Canonical Novell

References (86)

Vendor Advisory http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e...
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00060.html
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00061.html
Third Party Advisory http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00027.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00048.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00050.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00051.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00052.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00053.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00054.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-1847.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-1875.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-1883.html
Third Party Advisory http://www.debian.org/security/2016/dsa-3607
Vendor Advisory http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.3
Mailing List http://www.openwall.com/lists/oss-security/2016/06/24/5
and 66 more references
59
/ 100
high-risk
Severity 24/34 · High
Exploitability 16/34 · Moderate
Exposure 19/34 · Moderate