Vulnerability Description
The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service (system crash) via a rename system call, related to fs/namei.c and fs/open.c.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | <= 4.5.4 |
| Oracle | Linux | 6 |
| Oracle | Vm Server | 3.4 |
Related Weaknesses (CWE)
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54d5caIssue TrackingPatch
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9409e2Issue TrackingPatch
- http://rhn.redhat.com/errata/RHSA-2016-1847.html
- http://rhn.redhat.com/errata/RHSA-2016-1875.html
- http://rhn.redhat.com/errata/RHSA-2016-2574.html
- http://rhn.redhat.com/errata/RHSA-2016-2584.html
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.5Release Notes
- http://www.openwall.com/lists/oss-security/2016/07/11/8ExploitMailing ListThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.hThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmVendor Advisory
- http://www.securityfocus.com/bid/91709
- http://www.securitytracker.com/id/1036273
- https://bugzilla.redhat.com/show_bug.cgi?id=1355654Issue Tracking
- https://github.com/torvalds/linux/commit/54d5ca871e72f2bb172ec9323497f01cd5091ecIssue TrackingPatch
- https://github.com/torvalds/linux/commit/9409e22acdfc9153f88d9b1ed2bd2a5b34d2d3cIssue TrackingPatch
FAQ
What is CVE-2016-6198?
CVE-2016-6198 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows local users to cause a denial of service ...
How severe is CVE-2016-6198?
CVE-2016-6198 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-6198?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Oracle Linux, Oracle Vm Server.