CVE-2016-3672

HIGH

Linux kernel <4.5.2 - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-3672. PoCs published by Hector Marco & Ismael Ripoll.

AI-analyzed exploit summary This writeup describes CVE-2016-3672, a weakness in Linux ASLR implementation where setting RLIMIT_STACK to unlimited disables ASLR for 32-bit applications. It includes steps to reproduce the issue and a proposed patch.

Description

The arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux kernel through 4.5.2 does not properly randomize the legacy base address, which makes it easier for local users to defeat the intended restrictions on the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism for a setuid or setgid program, by disabling stack-consumption resource limits.

Exploits (1)

exploitdb WRITEUP
by Hector Marco & Ismael Ripoll · textdoslinux_x86
https://www.exploit-db.com/exploits/39669

This writeup describes CVE-2016-3672, a weakness in Linux ASLR implementation where setting RLIMIT_STACK to unlimited disables ASLR for 32-bit applications. It includes steps to reproduce the issue and a proposed patch.

Classification
Writeup 100%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: Linux Kernel (x86 and x86_64 in legacy mode)
No auth needed
Prerequisites: Ability to run 32-bit applications on a x86 machine · Permission to set RLIMIT_STACK to unlimited
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (28)

Core 28
Core References
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3004-1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3001-1
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/537996/100/0/threaded
Mailing List mailing-list x_refsource_fulldisc
http://seclists.org/fulldisclosure/2016/Apr/26
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/85884
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:1062
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2997-1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3000-1
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3607
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3002-1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2996-1
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182524.html
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2018:0676
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/39669/
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2989-1
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1324749
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1035506
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3003-1
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2998-1
Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html

Scores

CVSS v3 7.8
EPSS 0.0117
EPSS Percentile 63.5%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-254
Status published
Products (11)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 15.10
linux/linux_kernel < 4.5.2
novell/suse_linux_enterprise_desktop 12.0
novell/suse_linux_enterprise_live_patching 12.0
novell/suse_linux_enterprise_module_for_public_cloud 12.0
novell/suse_linux_enterprise_real_time_extension 12.0 sp1
novell/suse_linux_enterprise_server 12.0
novell/suse_linux_enterprise_software_development_kit 12.0
... and 1 more
Published Apr 27, 2016
Tracked Since Feb 18, 2026