HIGH · 7.8

CVE-2016-1583

The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vector...

Vulnerability Description

The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vectors involving crafted mmap calls for /proc pathnames, leading to recursive pagefault handling.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
LinuxLinux Kernel>= 2.6.19, < 3.18.54
NovellSuse Linux Enterprise Software Development Kit11.0
NovellSuse Linux Enterprise Debuginfo11.0
NovellSuse Linux Enterprise Desktop12.0
NovellSuse Linux Enterprise Live Patching12.0
NovellSuse Linux Enterprise Module For Public Cloud12
NovellSuse Linux Enterprise Server11.0
NovellSuse Linux Enterprise Workstation Extension12.0
CanonicalUbuntu Linux12.04
DebianDebian Linux8.0

Related Weaknesses (CWE)

References

FAQ

What is CVE-2016-1583?

CVE-2016-1583 is a vulnerability with a CVSS score of 7.8 (HIGH). The ecryptfs_privileged_open function in fs/ecryptfs/kthread.c in the Linux kernel before 4.6.3 allows local users to gain privileges or cause a denial of service (stack memory consumption) via vector...

How severe is CVE-2016-1583?

CVE-2016-1583 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-1583?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Novell Suse Linux Enterprise Software Development Kit, Novell Suse Linux Enterprise Debuginfo, Novell Suse Linux Enterprise Desktop, Novell Suse Linux Enterprise Live Patching.