GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
usn-3161-3
Vulnerability from osv_ubuntu
Published
2016-12-20 21:31
Modified
2026-02-10 04:41
Summary
linux-raspi2 vulnerabilities
Details

Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the TTY implementation in the Linux kernel. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2015-8964)

It was discovered that the Video For Linux Two (v4l2) implementation in the Linux kernel did not properly handle multiple planes when processing a VIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2016-4568)

CAI Qian discovered that shared bind mounts in a mount namespace exponentially added entries without restriction to the Linux kernel's mount table. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-6213)

Ondrej Kozina discovered that the keyring interface in the Linux kernel contained a buffer overflow when displaying timeout events via the /proc/keys interface. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-7042)

Andreas Gruenbacher and Jan Kara discovered that the filesystem implementation in the Linux kernel did not clear the setgid bit during a setxattr call. A local attacker could use this to possibly elevate group privileges. (CVE-2016-7097)

Marco Grassi discovered that the driver for Areca RAID Controllers in the Linux kernel did not properly validate control messages. A local attacker could use this to cause a denial of service (system crash) or possibly gain privileges. (CVE-2016-7425)

It was discovered that the KVM implementation for x86/x86_64 in the Linux kernel could dereference a null pointer. An attacker in a guest virtual machine could use this to cause a denial of service (system crash) in the KVM host. (CVE-2016-8630)

Eyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation in the Linux kernel contained a buffer overflow when handling fragmented packets. A remote attacker could use this to possibly execute arbitrary code with administrative privileges. (CVE-2016-8633)

Marco Grassi discovered that the TCP implementation in the Linux kernel mishandles socket buffer (skb) truncation. A local attacker could use this to cause a denial of service (system crash). (CVE-2016-8645)

Daxing Guo discovered a stack-based buffer overflow in the Broadcom IEEE802.11n FullMAC driver in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly gain privileges. (CVE-2016-8658)

It was discovered that an information leak existed in __get_user_asm_ex() in the Linux kernel. A local attacker could use this to expose sensitive information. (CVE-2016-9178)

Andrey Konovalov discovered that the SCTP implementation in the Linux kernel improperly handled validation of incoming data. A remote attacker could use this to cause a denial of service (system crash). (CVE-2016-9555)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2015-8964",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-4568",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-6213",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-7042",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-7097",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-7425",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8630",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8633",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8645",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-8658",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9178",
              "severity": [
                {
                  "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2016-9555",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "linux-headers-4.4.0-1038-raspi2",
            "binary_version": "4.4.0-1038.45"
          },
          {
            "binary_name": "linux-image-4.4.0-1038-raspi2",
            "binary_version": "4.4.0-1038.45"
          },
          {
            "binary_name": "linux-raspi2-headers-4.4.0-1038",
            "binary_version": "4.4.0-1038.45"
          },
          {
            "binary_name": "linux-raspi2-tools-4.4.0-1038",
            "binary_version": "4.4.0-1038.45"
          },
          {
            "binary_name": "linux-tools-4.4.0-1038-raspi2",
            "binary_version": "4.4.0-1038.45"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "linux-raspi2",
        "purl": "pkg:deb/ubuntu/linux-raspi2@4.4.0-1038.45?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.4.0-1038.45"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.2.0-1013.19",
        "4.2.0-1014.21",
        "4.3.0-1006.6",
        "4.4.0-1003.4",
        "4.4.0-1004.5",
        "4.4.0-1009.10",
        "4.4.0-1010.12",
        "4.4.0-1010.13",
        "4.4.0-1012.16",
        "4.4.0-1016.22",
        "4.4.0-1017.23",
        "4.4.0-1019.25",
        "4.4.0-1021.27",
        "4.4.0-1023.29",
        "4.4.0-1027.33",
        "4.4.0-1029.36",
        "4.4.0-1034.41"
      ]
    }
  ],
  "aliases": [],
  "details": "Tilman Schmidt and Sasha Levin discovered a use-after-free condition in the\nTTY implementation in the Linux kernel. A local attacker could use this to\nexpose sensitive information (kernel memory). (CVE-2015-8964)\n\nIt was discovered that the Video For Linux Two (v4l2) implementation in the\nLinux kernel did not properly handle multiple planes when processing a\nVIDIOC_DQBUF ioctl(). A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code. (CVE-2016-4568)\n\nCAI Qian discovered that shared bind mounts in a mount namespace\nexponentially added entries without restriction to the Linux kernel\u0027s mount\ntable. A local attacker could use this to cause a denial of service (system\ncrash). (CVE-2016-6213)\n\nOndrej Kozina discovered that the keyring interface in the Linux kernel\ncontained a buffer overflow when displaying timeout events via the\n/proc/keys interface. A local attacker could use this to cause a denial of\nservice (system crash). (CVE-2016-7042)\n\nAndreas Gruenbacher and Jan Kara discovered that the filesystem\nimplementation in the Linux kernel did not clear the setgid bit during a\nsetxattr call. A local attacker could use this to possibly elevate group\nprivileges. (CVE-2016-7097)\n\nMarco Grassi discovered that the driver for Areca RAID Controllers in the\nLinux kernel did not properly validate control messages. A local attacker\ncould use this to cause a denial of service (system crash) or possibly gain\nprivileges. (CVE-2016-7425)\n\nIt was discovered that the KVM implementation for x86/x86_64 in the Linux\nkernel could dereference a null pointer. An attacker in a guest virtual\nmachine could use this to cause a denial of service (system crash) in the\nKVM host. (CVE-2016-8630)\n\nEyal Itkin discovered that the IP over IEEE 1394 (FireWire) implementation\nin the Linux kernel contained a buffer overflow when handling fragmented\npackets. A remote attacker could use this to possibly execute arbitrary\ncode with administrative privileges. (CVE-2016-8633)\n\nMarco Grassi discovered that the TCP implementation in the Linux kernel\nmishandles socket buffer (skb) truncation. A local attacker could use this\nto cause a denial of service (system crash). (CVE-2016-8645)\n\nDaxing Guo discovered a stack-based buffer overflow in the Broadcom\nIEEE802.11n FullMAC driver in the Linux kernel. A local attacker could use\nthis to cause a denial of service (system crash) or possibly gain\nprivileges. (CVE-2016-8658)\n\nIt was discovered that an information leak existed in __get_user_asm_ex()\nin the Linux kernel. A local attacker could use this to expose sensitive\ninformation. (CVE-2016-9178)\n\nAndrey Konovalov discovered that the SCTP implementation in the Linux\nkernel improperly handled validation of incoming data. A remote attacker\ncould use this to cause a denial of service (system crash). (CVE-2016-9555)\n",
  "id": "USN-3161-3",
  "modified": "2026-02-10T04:41:04Z",
  "published": "2016-12-20T21:31:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-3161-3"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-8964"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-4568"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-6213"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-7042"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-7097"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-7425"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8630"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8633"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8645"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-8658"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9178"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2016-9555"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "linux-raspi2 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2015-8964",
    "UBUNTU-CVE-2016-4568",
    "UBUNTU-CVE-2016-6213",
    "UBUNTU-CVE-2016-7042",
    "UBUNTU-CVE-2016-7097",
    "UBUNTU-CVE-2016-7425",
    "UBUNTU-CVE-2016-8630",
    "UBUNTU-CVE-2016-8633",
    "UBUNTU-CVE-2016-8645",
    "UBUNTU-CVE-2016-8658",
    "UBUNTU-CVE-2016-9178",
    "UBUNTU-CVE-2016-9555"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.