Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

None

Privileges Required

Low

Attack Vector

Local

0

CVE-2016-4997

Disclosure Date: July 03, 2016 •

CVE-2016-4997 CVSS v3 Base Score: 7.8

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Metasploit Module

Linux Kernel 4.6.3 Netfilter Privilege Escalation

Description

The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

7.8 High

Impact Score:

5.9

Exploitability Score:

1.8

Vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV):

Local

Attack Complexity (AC):

Low

Privileges Required (PR):

Low

User Interaction (UI):

None

Scope (S):

Unchanged

Confidentiality (C):

High

Integrity (I):

High

Availability (A):

High

Vendors

canonical,
debian,
linux,
novell,
oracle

Products

debian linux 8.0,
linux 7,
linux kernel,
suse linux enterprise desktop 12.0,
suse linux enterprise live patching 12.0,
suse linux enterprise module for public cloud 12.0,
suse linux enterprise real time extension 12.0,
suse linux enterprise server 12.0,
suse linux enterprise software development kit 12.0,
suse linux enterprise workstation extension 12.0,
ubuntu linux 12.04,
ubuntu linux 14.04,
ubuntu linux 15.10,
ubuntu linux 16.04

Metasploit Modules

Linux Kernel 4.6.3 Netfilter Privilege Escalation (https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb)

References

Canonical

CVE-2016-4997 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4997)

BID-91451 (http://www.securityfocus.com/bid/91451)

Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00053.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00060.html

USN-3017-1 (http://www.ubuntu.com/usn/USN-3017-1)

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.html

USN-3017-3 (http://www.ubuntu.com/usn/USN-3017-3)

http://rhn.redhat.com/errata/RHSA-2016-1847.html

https://bugzilla.redhat.com/show_bug.cgi?id=1349722

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html

USN-3018-2 (http://www.ubuntu.com/usn/USN-3018-2)

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00048.html

USN-3017-2 (http://www.ubuntu.com/usn/USN-3017-2)

http://rhn.redhat.com/errata/RHSA-2016-1875.html

USN-3019-1 (http://www.ubuntu.com/usn/USN-3019-1)

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00027.html

DSA-3607 (http://www.debian.org/security/2016/dsa-3607)

USN-3016-2 (http://www.ubuntu.com/usn/USN-3016-2)

USN-3016-1 (http://www.ubuntu.com/usn/USN-3016-1)

[oss-security] 20160624 Linux CVE-2016-4997 (local privilege escalation) and CVE-2016-4998 (out of bounds memory access) (http://www.openwall.com/lists/oss-security/2016/06/24/5)

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00054.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00051.html

EXPLOIT-DB-40435 (https://www.exploit-db.com/exploits/40435)

https://github.com/torvalds/linux/commit/ce683e5f9d045e5d67d1312a42b359cb2ab2a13c

USN-3018-1 (http://www.ubuntu.com/usn/USN-3018-1)

SECTRACK-1036171 (http://www.securitytracker.com/id/1036171)

EXPLOIT-DB-40489 (https://www.exploit-db.com/exploits/40489)

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05347541

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00050.html

http://rhn.redhat.com/errata/RHSA-2016-1883.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00052.html

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html

USN-3016-3 (http://www.ubuntu.com/usn/USN-3016-3)

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00061.html

[oss-security] 20160929 CVE request - Linux kernel through 4.6.2 allows escalade privileges via IP6T_SO_SET_REPLACE compat setsockopt call (http://www.openwall.com/lists/oss-security/2016/09/29/10)

USN-3016-4 (http://www.ubuntu.com/usn/USN-3016-4)

http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.3

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=ce683e5f9d045e5d67d1312a42b359cb2ab2a13c

USN-3020-1 (http://www.ubuntu.com/usn/USN-3020-1)

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html

Miscellaneous

https://github.com/nccgroup/TriforceLinuxSyscallFuzzer/tree/master/crash_reports/report_compatIpt

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d045e5d67d1312a42b359cb2ab2a13c

https://access.redhat.com/errata/RHSA-2016:1847

https://access.redhat.com/errata/RHSA-2016:1875

https://access.redhat.com/errata/RHSA-2016:1883

https://access.redhat.com/security/cve/CVE-2016-4997

https://www.exploit-db.com/exploits/40435/

https://www.exploit-db.com/exploits/40489/

Rapid7

Technical Analysis