CVE-2016-10153
HighSummary
The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, potentially leading to system crashes or memory corruption by local users.
Risk Assessment
The organization may experience service interruptions or data corruption, impacting operational continuity and information security.
Recommendation
It is recommended to update the Linux kernel to version 4.9.6 or later to mitigate this vulnerability.
Other vulnerabilities in Linux kernel 4.9.x before 4.9.6
See all- CVE-2017-8072High
The cp2112_gpio_direction_input function in the Linux kernel 4.9.x before 4.9.9 does not return the expected EIO error status for a zero-length report, which may lead to an unspecified impact on local users.
- CVE-2017-8070High
In the Linux kernel 4.9.x before version 4.9.11, there is a bug in drivers/net/usb/catc.c that incorrectly interacts with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service or memory corruption.
- CVE-2017-8069High
In the Linux kernel 4.9.x before version 4.9.11, there is a bug in drivers/net/usb/rtl8150.c that incorrectly interacts with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service or memory corruption.
- CVE-2017-8068High
In the Linux kernel 4.9.x before 4.9.11, there is a bug in drivers/net/usb/pegasus.c that incorrectly interacts with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service or memory corruption.
- CVE-2017-5548High
In the Linux kernel version 4.9.x before 4.9.6, there is a bug in atusb.c that incorrectly interacts with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service (system crash or memory corruption) by leveraging the use of more than one virtual page for a DMA scatterlist.
- CVE-2017-5547High
In the Linux kernel 4.9.x before version 4.9.6, there is a bug in drivers/hid/hid-corsair.c that interacts incorrectly with the CONFIG_VMAP_STACK option. This allows local users to cause a denial of service or memory corruption.
Original NVD description (English source)
The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging reliance on earlier net/ceph/crypto.c code.