CVE-2016-3134
HighSummary
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, allowing local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
Risk Assessment
The organization may be exposed to unauthorized access to the system or service destabilization, potentially leading to serious operational issues.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in Linux kernel (netfilter subsystem)
See all- CVE-2016-4998High
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value.
- CVE-2016-4997High
A vulnerability in the setsockopt implementation in the netfilter subsystem of the Linux kernel before version 4.6.3 allows local users to gain privileges or cause a denial of service by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
Original NVD description (English source)
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.