CVE-2016-5244

HIGH

Fedora < 4.6.3 - Information Disclosure

Title source: rule
STIX 2.1

Description

The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.

References (24)

Core 24
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3070-1
Mailing List, Technical Description mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2016/06/03/5
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3070-3
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041895
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91021
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3607
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3070-2
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1343337
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3071-1
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3070-4
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3072-2
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3072-1
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-3071-2
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
Patch x_refsource_confirm
https://patchwork.ozlabs.org/patch/629110/

Scores

CVSS v3 7.5
EPSS 0.0056
EPSS Percentile 68.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (16)
fedoraproject/fedora 23
fedoraproject/fedora 24
fedoraproject/fedora 22
linux/linux_kernel < 4.6.3
redhat/enterprise_linux 6.0
redhat/enterprise_linux 5
suse/linux_enterprise_debuginfo 11 sp4
suse/linux_enterprise_desktop 12
suse/linux_enterprise_real_time_extension 11 sp4
suse/linux_enterprise_real_time_extension 12 sp1
... and 6 more
Published Jun 27, 2016
Tracked Since Feb 18, 2026