FKIE_CVE-2016-9644

Vulnerability from fkie_nvd - Published: 2016-11-28 03:59 - Updated: 2026-06-17 00:56
Severity
7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this vulnerability exists because of incorrect backporting of the CVE-2016-9178 patch to older kernels.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/07/4Mailing List, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94545
cve@mitre.orghttp://www.ubuntu.com/usn/USN-3146-1
cve@mitre.orghttp://www.ubuntu.com/usn/USN-3146-2
cve@mitre.orghttps://lwn.net/Articles/705220/Product
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/07/4Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94545
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-3146-1
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-3146-2
af854a3a-2127-422b-91ae-364da2661108https://lwn.net/Articles/705220/Product
Impacted products
Vendor Product Version
linux linux_kernel 4.4.22
linux linux_kernel 4.4.23
linux linux_kernel 4.4.24
linux linux_kernel 4.4.25
linux linux_kernel 4.4.26
linux linux_kernel 4.4.27
linux linux_kernel 4.4.28
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.4.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "69FD6F60-3836-4F63-826D-FC3CBAE3D338",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.4.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "04EB1200-5662-4AB8-913F-7517471BA12F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.4.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "96CBD63C-722B-4D8E-BD73-9DB23831B291",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.4.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "6959AD65-8A87-4B9F-A829-1ED0294FE222",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.4.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "273AF0D4-6C6A-4068-8C40-A4D1F0B30824",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.4.27:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8019864-3F8D-461A-A34A-EA0EDA13A763",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.4.28:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F69BAE1-5306-4A37-B97A-C0AF1E7E84B1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application.  NOTE: this vulnerability exists because of incorrect backporting of the CVE-2016-9178 patch to older kernels."
    },
    {
      "lang": "es",
      "value": "El macro __get_user_asm_ex en arch/x86/include/asm/uaccess.h en el kernel Linux 4.4.22 hasta la versi\u00f3n 4.4.28 contiene declaraciones asm extendidas que son incompatibles con la tabla de excepci\u00f3n, lo que permite a usuarios locales obtener acceso de root en plataformas non-SMEP a trav\u00e9s de una aplicaci\u00f3n manipulada. NOTA: esta vulnerabilidad existe debido a un incorrecto backporting del parche CVE-2016-9178 en kernels antiguos."
    }
  ],
  "id": "CVE-2016-9644",
  "lastModified": "2026-06-17T00:56:24.060",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-11-28T03:59:18.283",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2016/11/07/4"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/94545"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-3146-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/USN-3146-2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Product"
      ],
      "url": "https://lwn.net/Articles/705220/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2016/11/07/4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/94545"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-3146-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-3146-2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product"
      ],
      "url": "https://lwn.net/Articles/705220/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.