CVE Vulnerabilities

CVE-2016-10088

Use After Free

Published: Dec 30, 2016 | Modified: Apr 12, 2025
CVSS 3.x
7
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6.9 MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
7 MODERATE
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Ubuntu
LOW

The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.

Weakness

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Affected Software

Name Vendor Start Version End Version
Linux_kernel Linux * 3.10.107 (excluding)
Linux_kernel Linux 3.11 (including) 3.12.70 (excluding)
Linux_kernel Linux 3.13 (including) 3.16.40 (excluding)
Linux_kernel Linux 3.17 (including) 3.18.47 (excluding)
Linux_kernel Linux 3.19 (including) 4.1.38 (excluding)
Linux_kernel Linux 4.2 (including) 4.4.41 (excluding)
Linux_kernel Linux 4.5 (including) 4.8.17 (excluding)
Linux_kernel Linux 4.9 (including) 4.9.2 (excluding)
Red Hat Enterprise Linux 6 RedHat kernel-0:2.6.32-696.el6 *
Red Hat Enterprise Linux 7 RedHat kernel-rt-0:3.10.0-693.rt56.617.el7 *
Red Hat Enterprise Linux 7 RedHat kernel-0:3.10.0-693.el7 *
Red Hat Enterprise MRG 2 RedHat kernel-rt-1:3.10.0-693.2.1.rt56.585.el6rt *
Linux Ubuntu esm-infra-legacy/trusty *
Linux Ubuntu esm-infra/xenial *
Linux Ubuntu focal *
Linux Ubuntu precise *
Linux Ubuntu precise/esm *
Linux Ubuntu trusty *
Linux Ubuntu trusty/esm *
Linux Ubuntu upstream *
Linux Ubuntu vivid/ubuntu-core *
Linux Ubuntu xenial *
Linux Ubuntu yakkety *
Linux-armadaxp Ubuntu precise *
Linux-armadaxp Ubuntu upstream *
Linux-aws Ubuntu focal *
Linux-aws Ubuntu upstream *
Linux-aws Ubuntu xenial *
Linux-aws-5.15 Ubuntu focal *
Linux-aws-5.4 Ubuntu bionic *
Linux-aws-fips Ubuntu trusty *
Linux-aws-fips Ubuntu xenial *
Linux-aws-hwe Ubuntu xenial *
Linux-azure Ubuntu esm-infra/bionic *
Linux-azure Ubuntu focal *
Linux-azure Ubuntu upstream *
Linux-azure-4.15 Ubuntu bionic *
Linux-azure-5.15 Ubuntu focal *
Linux-azure-5.4 Ubuntu bionic *
Linux-azure-6.11 Ubuntu noble *
Linux-azure-fde Ubuntu esm-infra/focal *
Linux-azure-fde Ubuntu focal *
Linux-azure-fde-5.15 Ubuntu esm-infra/focal *
Linux-azure-fde-5.15 Ubuntu focal *
Linux-azure-fips Ubuntu trusty *
Linux-azure-fips Ubuntu xenial *
Linux-bluefield Ubuntu focal *
Linux-euclid Ubuntu upstream *
Linux-euclid Ubuntu xenial *
Linux-flo Ubuntu trusty *
Linux-flo Ubuntu upstream *
Linux-flo Ubuntu vivid/stable-phone-overlay *
Linux-flo Ubuntu xenial *
Linux-flo Ubuntu yakkety *
Linux-gcp Ubuntu esm-infra/bionic *
Linux-gcp Ubuntu focal *
Linux-gcp Ubuntu upstream *
Linux-gcp-4.15 Ubuntu bionic *
Linux-gcp-5.15 Ubuntu focal *
Linux-gcp-5.4 Ubuntu bionic *
Linux-gcp-6.11 Ubuntu noble *
Linux-gcp-fips Ubuntu trusty *
Linux-gcp-fips Ubuntu xenial *
Linux-gke Ubuntu esm-infra/focal *
Linux-gke Ubuntu focal *
Linux-gke Ubuntu upstream *
Linux-gkeop Ubuntu esm-infra/focal *
Linux-gkeop Ubuntu focal *
Linux-goldfish Ubuntu trusty *
Linux-goldfish Ubuntu upstream *
Linux-goldfish Ubuntu xenial *
Linux-goldfish Ubuntu yakkety *
Linux-goldfish Ubuntu zesty *
Linux-grouper Ubuntu trusty *
Linux-grouper Ubuntu upstream *
Linux-hwe Ubuntu esm-infra/bionic *
Linux-hwe Ubuntu upstream *
Linux-hwe-5.15 Ubuntu focal *
Linux-hwe-5.4 Ubuntu bionic *
Linux-hwe-6.11 Ubuntu noble *
Linux-hwe-edge Ubuntu esm-infra/bionic *
Linux-hwe-edge Ubuntu upstream *
Linux-hwe-edge Ubuntu xenial *
Linux-ibm Ubuntu focal *
Linux-ibm-5.15 Ubuntu focal *
Linux-ibm-5.4 Ubuntu bionic *
Linux-intel-iot-realtime Ubuntu jammy *
Linux-intel-iotg-5.15 Ubuntu focal *
Linux-iot Ubuntu focal *
Linux-kvm Ubuntu focal *
Linux-kvm Ubuntu upstream *
Linux-linaro-omap Ubuntu precise *
Linux-linaro-omap Ubuntu upstream *
Linux-linaro-shared Ubuntu precise *
Linux-linaro-shared Ubuntu upstream *
Linux-linaro-vexpress Ubuntu precise *
Linux-linaro-vexpress Ubuntu upstream *
Linux-lowlatency-hwe-5.15 Ubuntu focal *
Linux-lowlatency-hwe-6.11 Ubuntu noble *
Linux-lts-quantal Ubuntu precise *
Linux-lts-quantal Ubuntu precise/esm *
Linux-lts-quantal Ubuntu upstream *
Linux-lts-raring Ubuntu precise *
Linux-lts-raring Ubuntu precise/esm *
Linux-lts-raring Ubuntu upstream *
Linux-lts-saucy Ubuntu precise *
Linux-lts-saucy Ubuntu precise/esm *
Linux-lts-saucy Ubuntu upstream *
Linux-lts-trusty Ubuntu precise *
Linux-lts-trusty Ubuntu upstream *
Linux-lts-utopic Ubuntu trusty *
Linux-lts-utopic Ubuntu upstream *
Linux-lts-vivid Ubuntu trusty *
Linux-lts-vivid Ubuntu trusty/esm *
Linux-lts-vivid Ubuntu upstream *
Linux-lts-wily Ubuntu trusty *
Linux-lts-wily Ubuntu upstream *
Linux-lts-xenial Ubuntu trusty *
Linux-lts-xenial Ubuntu upstream *
Linux-maguro Ubuntu trusty *
Linux-maguro Ubuntu upstream *
Linux-mako Ubuntu trusty *
Linux-mako Ubuntu upstream *
Linux-mako Ubuntu vivid/stable-phone-overlay *
Linux-mako Ubuntu xenial *
Linux-mako Ubuntu yakkety *
Linux-manta Ubuntu trusty *
Linux-manta Ubuntu upstream *
Linux-nvidia-tegra-5.15 Ubuntu focal *
Linux-oem Ubuntu esm-infra/bionic *
Linux-oem Ubuntu upstream *
Linux-oracle Ubuntu bionic *
Linux-oracle Ubuntu focal *
Linux-oracle Ubuntu xenial *
Linux-oracle-5.15 Ubuntu focal *
Linux-oracle-5.4 Ubuntu bionic *
Linux-qcm-msm Ubuntu precise *
Linux-qcm-msm Ubuntu upstream *
Linux-raspi Ubuntu focal *
Linux-raspi-5.4 Ubuntu bionic *
Linux-raspi-realtime Ubuntu noble *
Linux-raspi2 Ubuntu esm-infra/focal *
Linux-raspi2 Ubuntu focal *
Linux-raspi2 Ubuntu upstream *
Linux-raspi2 Ubuntu vivid/ubuntu-core *
Linux-raspi2 Ubuntu xenial *
Linux-raspi2 Ubuntu yakkety *
Linux-realtime Ubuntu jammy *
Linux-realtime Ubuntu noble *
Linux-riscv Ubuntu esm-infra/focal *
Linux-riscv Ubuntu focal *
Linux-riscv Ubuntu jammy *
Linux-riscv Ubuntu noble *
Linux-riscv-5.15 Ubuntu focal *
Linux-snapdragon Ubuntu upstream *
Linux-snapdragon Ubuntu xenial *
Linux-snapdragon Ubuntu yakkety *
Linux-ti-omap4 Ubuntu precise *
Linux-ti-omap4 Ubuntu upstream *
Linux-xilinx-zynqmp Ubuntu focal *

Extended Description

The use of previously-freed memory can have any number of adverse consequences, ranging from the corruption of valid data to the execution of arbitrary code, depending on the instantiation and timing of the flaw. The simplest way data corruption may occur involves the system’s reuse of the freed memory. Use-after-free errors have two common and sometimes overlapping causes:

In this scenario, the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.

Potential Mitigations

References