CVE-2016-2143

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-2143
The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3446c13b268af86391d06611327006b059b8bab1 Patch Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-1539.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2766.html Third Party Advisory
http://www.debian.org/security/2016/dsa-3607 Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html Third Party Advisory
https://github.com/torvalds/linux/commit/3446c13b268af86391d06611327006b059b8bab1 Patch
https://security-tracker.debian.org/tracker/CVE-2016-2143 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:oracle:linux:7:0:*:*:*:*:*:*
History

14 Mar 2024, 19:59

Type Values Removed Values Added
References () http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3446c13b268af86391d06611327006b059b8bab1 - Vendor Advisory () http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3446c13b268af86391d06611327006b059b8bab1 - Patch, Vendor Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html - () http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html - Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html - () http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html - Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html - () http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html - Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html - () http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html - Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html - () http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html - Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - () http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - Third Party Advisory
References () http://rhn.redhat.com/errata/RHSA-2016-1539.html - () http://rhn.redhat.com/errata/RHSA-2016-1539.html - Third Party Advisory
References () http://rhn.redhat.com/errata/RHSA-2016-2766.html - () http://rhn.redhat.com/errata/RHSA-2016-2766.html - Third Party Advisory
References () http://www.debian.org/security/2016/dsa-3607 - () http://www.debian.org/security/2016/dsa-3607 - Third Party Advisory
References () http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - () http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html - Third Party Advisory
References () https://github.com/torvalds/linux/commit/3446c13b268af86391d06611327006b059b8bab1 - () https://github.com/torvalds/linux/commit/3446c13b268af86391d06611327006b059b8bab1 - Patch
References () https://security-tracker.debian.org/tracker/CVE-2016-2143 - () https://security-tracker.debian.org/tracker/CVE-2016-2143 - Third Party Advisory
CPE cpe:2.3:o:linux:linux_kernel:4.4:rc8:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:7:0:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
First Time Redhat enterprise Linux
Oracle
Oracle linux
Redhat

12 Feb 2023, 23:17

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2016-2143', 'name': 'https://access.redhat.com/security/cve/CVE-2016-2143', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:2766', 'name': 'https://access.redhat.com/errata/RHSA-2016:2766', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1308908', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1308908', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:1539', 'name': 'https://access.redhat.com/errata/RHSA-2016:1539', 'tags': [], 'refsource': 'MISC'}
Summary It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the address space limit for the child process. The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.

02 Feb 2023, 16:17

Type Values Removed Values Added
Summary The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h. It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the address space limit for the child process.
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2016-2143 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:2766 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1308908 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:1539 -
Information

Published : 2016-04-27 17:59

Updated : 2024-03-14 19:59

NVD link : CVE-2016-2143

Mitre link : CVE-2016-2143

CVE.ORG link : CVE-2016-2143

JSON object : View

Products Affected

oracle

  • linux

linux

  • linux_kernel

debian

  • debian_linux

redhat

  • enterprise_linux
CWE
CWE-20

Improper Input Validation