Tracker / CVE-2016-4470
CVE-2016-4470
Medium 5.5
The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.
Affected products and versions
| linux | linux_kernel · … → 4.6.3 |
|---|---|
| novell | suse_linux_enterprise_real_time_extension |
| oracle | linux |
| oracle | vm_server |
| redhat | enterprise_linux |
| redhat | enterprise_linux_desktop |
| redhat | enterprise_linux_for_real_time |
| redhat | enterprise_linux_hpc_node |
| redhat | enterprise_linux_hpc_node_eus |
| redhat | enterprise_linux_server |
| redhat | enterprise_linux_server_aus |
| redhat | enterprise_linux_server_eus |
| redhat | enterprise_linux_workstation |
| redhat | enterprise_mrg |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.