Vulnerability Details : CVE-2016-4485
The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain sensitive information from kernel stack memory by reading a message.
Vulnerability category: Information leak
Products affected by CVE-2016-4485
- cpe:2.3:o:novell:suse_linux_enterprise_server:11:sp4:*:*:*:*:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_server:11:extra:*:*:*:*:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
- cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:11.0:sp4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-4485
0.51%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-4485
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2016-4485
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-4485
-
https://github.com/torvalds/linux/commit/b8670c09f37bdf2847cc44f36511a53afc6161fd
net: fix infoleak in llc · torvalds/linux@b8670c0 · GitHubPatch;Vendor Advisory
-
http://www.ubuntu.com/usn/USN-3005-1
USN-3005-1: Linux kernel (Xenial HWE) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2989-1
USN-2989-1: Linux kernel vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1333309
1333309 – (CVE-2016-4485) CVE-2016-4485 kernel: Information leak in llc moduleIssue Tracking
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
[security-announce] SUSE-SU-2016:1672-1: important: Security update forThird Party Advisory
-
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b8670c09f37bdf2847cc44f36511a53afc6161fd
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
-
http://www.ubuntu.com/usn/USN-3001-1
USN-3001-1: Linux kernel (Vivid HWE) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.5
Release Notes
-
http://www.ubuntu.com/usn/USN-2996-1
USN-2996-1: Linux kernel vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2998-1
USN-2998-1: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-3000-1
USN-3000-1: Linux kernel (Utopic HWE) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-3007-1
USN-3007-1: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.html
[security-announce] openSUSE-SU-2016:1641-1: important: Security update
-
http://www.ubuntu.com/usn/USN-3002-1
USN-3002-1: Linux kernel (Wily HWE) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-3003-1
USN-3003-1: Linux kernel vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2997-1
USN-2997-1: Linux kernel (OMAP4) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html
[security-announce] SUSE-SU-2016:1985-1: important: Security update for
-
http://www.openwall.com/lists/oss-security/2016/05/04/26
oss-security - CVE Request: kernel information leak vulnerability in llc moduleMailing List
-
http://www.securityfocus.com/bid/90015
Linux Kernel 'net/llc/af_llc.c' Local Information Disclosure Vulnerability
-
http://www.ubuntu.com/usn/USN-3004-1
USN-3004-1: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.ubuntu.com/usn/USN-3006-1
USN-3006-1: Linux kernel vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.debian.org/security/2016/dsa-3607
Debian -- Security Information -- DSA-3607-1 linux
Jump to