CVE-2016-2856

Published: 13 March 2016

pt_chown in the glibc package before 2.19-18+deb8u4 on Debian jessie; the elibc package before 2.15-0ubuntu10.14 on Ubuntu 12.04 LTS and before 2.19-0ubuntu6.8 on Ubuntu 14.04 LTS; and the glibc package before 2.21-0ubuntu4.2 on Ubuntu 15.10 and before 2.23-0ubuntu1 on Ubuntu 16.04 LTS and 16.10 lacks a namespace check associated with file-descriptor passing, which allows local users to capture keystrokes and spoof data, and possibly gain privileges, via pts read and write operations, related to debian/sysdeps/linux.mk. NOTE: this is not considered a vulnerability in the upstream GNU C Library because the upstream documentation has a clear security recommendation against the --enable-pt_chown option.

From the Ubuntu Security Team

Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty files. A local attacker could use this to gain administrative privileges or expose sensitive information.

Priority

Cvss 3 Severity Score

8.4

Score breakdown

Status

Package	Release	Status
eglibc Launchpad, Ubuntu, Debian	precise	Released (2.15-0ubuntu10.14)
	trusty	Released (2.19-0ubuntu6.8)
	upstream	Needs triage
	wily	Does not exist
	xenial	Does not exist
	yakkety	Does not exist
	zesty	Does not exist
glibc Launchpad, Ubuntu, Debian	precise	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	wily	Released (2.21-0ubuntu4.2)
	xenial	Not vulnerable (2.23-0ubuntu1)
	yakkety	Not vulnerable (2.23-0ubuntu1)
	zesty	Not vulnerable (2.23-0ubuntu1)
	Patches: upstream: https://sourceware.org/git/?p=glibc.git;a=commit;h=77356912e83601fd0240d22fe4d960348b82b5c3

Severity score breakdown

Parameter	Value
Base score	8.4
Attack vector	Local
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›