CVE-2016-0728 (retired)

Priority
Description
The join_session_keyring function in security/keys/process_keys.c in the
Linux kernel before 4.4.1 mishandles object references in a certain error
case, which allows local users to gain privileges or cause a denial of
service (integer overflow and use-after-free) via crafted keyctl commands.
Ubuntu-Description
Yevgeny Pats discovered that the session keyring implementation in the
Linux kernel did not properly reference count when joining an existing
session keyring. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code with
administrative privileges.
Notes
jdstrandandroid kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support
Package
Source: linux (LP Ubuntu Debian)
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (4.3.0-7.18)
Patches:
Introduced by
3a50597de8635cd05133bd12c95681c82fe7b878
Fixed by
23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
This package is not directly supported by the Ubuntu Security Team
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (4.4.0-1001.10)
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (4.4.0-1003.3)
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (4.8.0-36.36~16.04.1)
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (4.8.0-36.36~16.04.1)
Product
linux-krillin:not-affected
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Patches:
This package is not directly supported by the Ubuntu Security Team
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
This package is not directly supported by the Ubuntu Security Team
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (4.4.0-1003.4)
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (4.4.0-1012.12)
Package
Upstream:released (4.5~rc1)
Ubuntu 16.04 LTS (Xenial Xerus):DNE
Product
linux-vegetahd:not-affected
More Information

Updated: 2019-10-09 07:54:39 UTC (commit 33aea848a182c0afcd0a3f927a01a7ecd9a061ee)