Summary
Yevgeny Pats discovered that the session keyring implementation in the
Linux kernel did not properly reference count when joining an existing
session keyring. A local attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code with
administrative privileges.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | linux-lts-wily | 4.2.0-25.30~14.04.1 |
Vulnerabilities 1
-
Unscored —CVE-2016-0728 Public exploit
The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object re…
References
-
report
https://ubuntu.com/security/CVE-2016-0728