CVE-2016-4913 : The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel befo

The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters, which allows local users to obtain sensitive information from kernel memory or possibly have unspecified other impact via a crafted isofs filesystem.

Published 2016-05-23 10:59:15

Updated 2023-09-12 14:45:07

Source Debian GNU/Linux

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2016-4913

Novell » Suse Linux Enterprise Server » Version: 11.0 Update SP4
cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp4:*:*:*:*:*:*
Matching versions
Novell » Suse Linux Enterprise Server » Version: 11.0 Update Extra
cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:extra:*:*:*:*:*:*
Matching versions
Novell » Suse Linux Enterprise Debuginfo » Version: 11.0 Update SP4
cpe:2.3:o:novell:suse_linux_enterprise_debuginfo:11.0:sp4:*:*:*:*:*:*
Matching versions
Novell » Suse Linux Enterprise Software Development Kit » Version: 11.0 Update SP4
cpe:2.3:a:novell:suse_linux_enterprise_software_development_kit:11.0:sp4:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.5 and before (<) 4.5.5
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.13 and before (<) 3.14.70
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.17 and before (<) 3.18.34
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions before (<) 3.2.81
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.19 and before (<) 4.1.25
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.2 and before (<) 4.4.11
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.11 and before (<) 3.12.60
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.15 and before (<) 3.16.36
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.3 and before (<) 3.10.102
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Oracle » Linux » Version: 6
cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 15.10
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Matching versions

Threat overview for CVE-2016-4913

Top countries where our scanners detected CVE-2016-4913

Top open port discovered on systems with this issue 49152

IPs affected by CVE-2016-4913 25,603

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2016-4913!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2016-4913

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 8 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-4913

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-4913

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-4913

http://www.ubuntu.com/usn/USN-3019-1

USN-3019-1: Linux kernel (Utopic HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3016-4

USN-3016-4: Linux kernel (Xenial HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3020-1

USN-3020-1: Linux kernel (Vivid HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2018:3096

RHSA-2018:3096 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3017-2

USN-3017-2: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html

[security-announce] SUSE-SU-2016:1672-1: important: Security update for
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2018:3083

RHSA-2018:3083 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.5

Vendor Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3016-1

USN-3016-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

Oracle VM Server for x86 Bulletin - October 2016
Third Party Advisory

CVEs referencing this url
https://bugzilla.redhat.com/show_bug.cgi?id=1337528

1337528 – (CVE-2016-4913) CVE-2016-4913 kernel: Information leak when handling NM entries containing NUL
Issue Tracking;Third Party Advisory;VDB Entry
https://github.com/torvalds/linux/commit/99d825822eade8d827a1817357cbf3f889a552d6

get_rock_ridge_filename(): handle malformed NM entries · torvalds/linux@99d8258 · GitHub
Vendor Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=99d825822eade8d827a1817357cbf3f889a552d6

kernel/git/torvalds/linux.git - Linux kernel source tree
Vendor Advisory
http://www.ubuntu.com/usn/USN-3016-3

USN-3016-3: Linux kernel (Qualcomm Snapdragon) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3021-1

USN-3021-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3021-2

USN-3021-2: Linux kernel (OMAP4) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3017-3

USN-3017-3: Linux kernel (Wily HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3018-1

USN-3018-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/90730

Linux Kernel 'fs/isofs/rock.c' Local Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html

[security-announce] SUSE-SU-2016:1985-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://www.debian.org/security/2016/dsa-3607

Debian -- Security Information -- DSA-3607-1 linux
Third Party Advisory

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Oracle Linux Bulletin - July 2016
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3017-1

USN-3017-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/05/18/3

oss-security - CVE Request: Linux: information leak in Rock Ridge Extensions to iso9660 -- fs/isofs/rock.c
Mailing List;Patch;Third Party Advisory
http://www.ubuntu.com/usn/USN-3018-2

USN-3018-2: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-3016-2

USN-3016-2: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/05/18/5

oss-security - Re: CVE Request: Linux: information leak in Rock Ridge Extensions to iso9660 -- fs/isofs/rock.c
Mailing List;Patch;Third Party Advisory