CVE-2016-2550

MEDIUM

Linux Kernel < 4.4.8 - Denial of Service via File Descriptor Mismanagement

Title source: llm
STIX 2.1

Description

The Linux kernel before 4.5 allows local users to bypass file-descriptor limits and cause a denial of service (memory consumption) by leveraging incorrect tracking of descriptor ownership and sending each descriptor over a UNIX socket before closing it. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-4312.

References (14)

Core 14
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1311517
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2949-1
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/02/23/2
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3503
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2947-3
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2947-2
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2947-1
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2946-2
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2948-1
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2946-1
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2948-2

Scores

CVSS v3 5.5
EPSS 0.0051
EPSS Percentile 40.6%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-399
Status published
Products (1)
linux/linux_kernel < 4.4.8
Published Apr 27, 2016
Tracked Since Feb 18, 2026