CVE-2016-9604

MEDIUM

Linux Kernel < 4.11 - Incorrect Permission Assignment

Title source: rule
STIX 2.1

Description

It was discovered in the Linux kernel before 4.11-rc8 that root can gain direct access to an internal keyring, such as '.dns_resolver' in RHEL-7 or '.builtin_trusted_keys' upstream, by joining it as its session keyring. This allows root to bypass module signature verification by adding a new public key of its own devising to the keyring.

References (8)

Core 8
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:2669
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9604
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.novell.com/show_bug.cgi?id=1035576
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/102135
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:2077
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:1842

Scores

CVSS v3 4.4
EPSS 0.0002
EPSS Percentile 5.0%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-732 CWE-347
Status published
Products (2)
linux/linux_kernel 4.11 rc1 (7 CPE variants)
linux/linux_kernel < 4.11
Published Jul 11, 2018
Tracked Since Feb 18, 2026