High Severity Vulnerability
This vulnerability has been rated as High severity. Immediate action is recommended.
CVE-2016-4805
High
Low
Medium
High
Critical
7.8
CVSS Score
Vulnerability Description
Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory corruption and system crash, or spinlock) or possibly have unspecified other impact by removing a network namespace, related to the ppp_register_net_channel and ppp_unregister_channel functions.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
L
Attack Complexity
L
Privileges Required
L
User Interaction
N
Scope
U
Confidentiality
H
Integrity
H
Availability
H
Known Affected Software
15 configuration(s) from 4 vendor(s)
ubuntu_linux
Version:
12.04
CPE:
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
suse_linux_enterprise_real_time_extension
Version:
11.0
CPE:
cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:11.0:sp4:*:*:*:*:*:*
suse_linux_enterprise_real_time_extension
Version:
12.0
CPE:
cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*
suse_linux_enterprise_live_patching
Version:
12.0
CPE:
cpe:2.3:o:novell:suse_linux_enterprise_live_patching:12.0:*:*:*:*:*:*:*
suse_linux_enterprise_server
Version:
11.0
CPE:
cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp4:*:*:*:*:*:*
suse_linux_enterprise_module_for_public_cloud
Version:
12.0
CPE:
cpe:2.3:o:novell:suse_linux_enterprise_module_for_public_cloud:12.0:*:*:*:*:*:*:*
opensuse_leap
Version:
42.1
CPE:
cpe:2.3:o:novell:opensuse_leap:42.1:*:*:*:*:*:*:*
suse_linux_enterprise_software_development_kit
Version:
11.0
CPE:
cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:11.0:sp4:*:*:*:*:*:*
suse_linux_enterprise_server
Version:
12.0
CPE:
cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:-:*:*:*:*:*:*
suse_linux_enterprise_workstation_extension
Version:
12.0
CPE:
cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:sp1:*:*:*:*:*:*
suse_linux_enterprise_desktop
Version:
12.0
CPE:
cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:-:*:*:*:*:*:*
suse_linux_enterprise_software_development_kit
Version:
12.0
CPE:
cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:12.0:-:*:*:*:*:*:*
linux
Version:
6
CPE:
cpe:2.3:o:oracle:linux:6:10:*:*:*:*:*:*
enterprise_linux
Version:
7.0
CPE:
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:intel64:*
enterprise_linux
Version:
6.0
CPE:
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:intel64:*
This vulnerability affects 15 software configuration(s). Ensure you patch all affected systems.
References & Resources
-
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89cve@mitre.org Patch Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.htmlcve@mitre.org Mailing List Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlcve@mitre.org Mailing List Release Notes Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.htmlcve@mitre.org Mailing List Release Notes Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.htmlcve@mitre.org Mailing List Release Notes Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.htmlcve@mitre.org Mailing List Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.htmlcve@mitre.org Mailing List Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.htmlcve@mitre.org Mailing List Third Party Advisory
-
http://www.debian.org/security/2016/dsa-3607cve@mitre.org Third Party Advisory
-
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.2cve@mitre.org Mailing List Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2016/05/15/2cve@mitre.org Mailing List Patch Third Party Advisory
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlcve@mitre.org Third Party Advisory
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.htmlcve@mitre.org Third Party Advisory
-
http://www.securityfocus.com/bid/90605cve@mitre.org Third Party Advisory VDB Entry
-
http://www.securitytracker.com/id/1036763cve@mitre.org Third Party Advisory VDB Entry
-
http://www.ubuntu.com/usn/USN-3021-1cve@mitre.org Third Party Advisory
-
http://www.ubuntu.com/usn/USN-3021-2cve@mitre.org Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1335803cve@mitre.org Issue Tracking Third Party Advisory
-
https://github.com/torvalds/linux/commit/1f461dcdd296eecedaffffc6bae2bfa90bd7eb89cve@mitre.org Patch Third Party Advisory
-
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89af854a3a-2127-422b-91ae-364da2661108 Patch Vendor Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Release Notes Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Release Notes Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Release Notes Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.htmlaf854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
http://www.debian.org/security/2016/dsa-3607af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.2af854a3a-2127-422b-91ae-364da2661108 Mailing List Vendor Advisory
-
http://www.openwall.com/lists/oss-security/2016/05/15/2af854a3a-2127-422b-91ae-364da2661108 Mailing List Patch Third Party Advisory
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://www.securityfocus.com/bid/90605af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory VDB Entry
-
http://www.securitytracker.com/id/1036763af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory VDB Entry
-
http://www.ubuntu.com/usn/USN-3021-1af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
http://www.ubuntu.com/usn/USN-3021-2af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1335803af854a3a-2127-422b-91ae-364da2661108 Issue Tracking Third Party Advisory
-
https://github.com/torvalds/linux/commit/1f461dcdd296eecedaffffc6bae2bfa90bd7eb89af854a3a-2127-422b-91ae-364da2661108 Patch Third Party Advisory
Severity Details
7.8
out of 10.0
High
Weakness Type (CWE)
CWE-416
Top 25 #12
Use After Free
- Description
- The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations…
- Exploit Likelihood
- High
- Typical Severity
- High
- Abstraction Level
- Variant
Key Information
- Published Date
- May 23, 2016
