4.4

CVE-2016-9604

It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version <= 4.11
Linux ≫ Linux Kernel Version4.11 Updaterc1
Linux ≫ Linux Kernel Version4.11 Updaterc2
Linux ≫ Linux Kernel Version4.11 Updaterc3
Linux ≫ Linux Kernel Version4.11 Updaterc4
Linux ≫ Linux Kernel Version4.11 Updaterc5
Linux ≫ Linux Kernel Version4.11 Updaterc6
Linux ≫ Linux Kernel Version4.11 Updaterc7
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.172
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.4 0.8 3.6
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:N/I:P/A:N
secalert@redhat.com 4.4 0.8 3.6
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://access.redhat.com/errata/RHSA-2017:1842
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2077
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2669
Third Party Advisory
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-9604.html
Third Party Advisory
http://www.securityfocus.com/bid/102135
Third Party Advisory
VDB Entry
https://bugzilla.novell.com/show_bug.cgi?id=1035576
Third Party Advisory
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9604
Third Party Advisory
Issue Tracking
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ee8f844e3c5a73b999edf733df1c529d6503ec2f
Patch
Vendor Advisory