CVE-2016-2117 : The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enable

The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.

Published 2016-05-02 10:59:28

Updated 2023-02-12 23:17:21

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2016-2117

Probability of exploitation activity in the next 30 days: 0.33%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 67 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2016-2117

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2016-2117

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-2117

http://www.ubuntu.com/usn/USN-3005-1

USN-3005-1: Linux kernel (Xenial HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2989-1

USN-2989-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2574.html

RHSA-2016:2574 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://www.securityfocus.com/bid/84500

Linux Kernel CVE-2016-2117 Remote Buffer Overflow Vulnerability
https://github.com/torvalds/linux/commit/f43bfaeddc79effbf3d0fcb53ca477cca66f3db8

atl2: Disable unimplemented scatter/gather feature · torvalds/linux@f43bfae · GitHub
Vendor Advisory
http://www.ubuntu.com/usn/USN-3001-1

USN-3001-1: Linux kernel (Vivid HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=1312298

1312298 – (CVE-2016-2117) CVE-2016-2117 kernel: Kernel memory leakage to ethernet frames due to buffer overflow in ethernet drivers
Issue Tracking
http://www.openwall.com/lists/oss-security/2016/03/16/7

oss-security - CVE-2016-2117 memory disclosure to ethernet due to unchecked scatter/gather IO
http://www.ubuntu.com/usn/USN-2998-1

USN-2998-1: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3000-1

USN-3000-1: Linux kernel (Utopic HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3007-1

USN-3007-1: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3002-1

USN-3002-1: Linux kernel (Wily HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3003-1

USN-3003-1: Linux kernel vulnerabilities | Ubuntu security notices

CVEs referencing this url
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f43bfaeddc79effbf3d0fcb53ca477cca66f3db8

kernel/git/torvalds/linux.git - Linux kernel source tree
Vendor Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Oracle VM Server for x86 Bulletin - July 2016

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3004-1

USN-3004-1: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2016-2584.html

RHSA-2016:2584 - Security Advisory - Red Hat Customer Portal

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3006-1

USN-3006-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.debian.org/security/2016/dsa-3607

Debian -- Security Information -- DSA-3607-1 linux

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Oracle Linux Bulletin - July 2016

CVEs referencing this url

Products affected by CVE-2016-2117

Linux » Linux Kernel
Versions up to, including, (<=) 4.5.2
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Oracle » Vm Server » Version: 3.3
cpe:2.3:o:oracle:vm_server:3.3:*:*:*:*:*:*:*
Matching versions
Oracle » Vm Server » Version: 3.4
cpe:2.3:o:oracle:vm_server:3.4:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.10
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions

Vulnerability Details : CVE-2016-2117

Exploit prediction scoring system (EPSS) score for CVE-2016-2117

CVSS scores for CVE-2016-2117

CWE ids for CVE-2016-2117

References for CVE-2016-2117

Products affected by CVE-2016-2117