Vulnerability Details : CVE-2016-1886
Potential exploit
Integer signedness error in the genkbd_commonioctl function in sys/dev/kbd/kbd.c in FreeBSD 9.3 before p42, 10.1 before p34, 10.2 before p17, and 10.3 before p3 allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory overwrite and kernel crash), or gain privileges via a negative value in the flen structure member in the arg argument in a SETFKEY ioctl call, which triggers a "two way heap and stack overflow."
Vulnerability category: Denial of service
Products affected by CVE-2016-1886
- cpe:2.3:o:freebsd:freebsd:9.3:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:10.1:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:10.2:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:10.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-1886
0.78%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 71 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-1886
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2016-1886
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-1886
-
https://www.freebsd.org/security/advisories/FreeBSD-SA-16:18.atkbd.asc
Vendor Advisory
-
https://security.FreeBSD.org/patches/SA-16:18/atkbd.patch
Patch
-
http://www.securityfocus.com/bid/90734
FreeBSD CVE-2016-1886 Local Buffer Overflow Vulnerability
-
http://www.securitytracker.com/id/1035905
FreeBSD Buffer Overflow in Keyboard Driver Lets Local Users Gain Elevated Privileges - SecurityTracker
-
http://cturt.github.io/SETFKEY.html
Analysis of CVE-2016-1886, SETFKEY FreeBSD kernel vulnerabilityExploit
Jump to