CVE-2016-4997
HighSummary
A vulnerability in the setsockopt implementation in the netfilter subsystem of the Linux kernel before version 4.6.3 allows local users to gain privileges or cause a denial of service by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
Risk Assessment
Organizations may be exposed to unauthorized access to systems or service destabilization, potentially leading to serious security and availability issues.
Recommendation
It is recommended to update the Linux kernel to version 4.6.3 or later to mitigate this vulnerability.
Other vulnerabilities in Linux kernel netfilter subsystem
See all- CVE-2016-4998High
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value.
- CVE-2016-3134High
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, allowing local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.
Original NVD description (English source)
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.