{"id":"CVE-2016-2085","aliases":["DEBIAN-CVE-2016-2085","EUVD-2016-3190","GHSA-w99v-p99f-6f3g","MGASA-2016-0225","MGASA-2016-0232","MGASA-2016-0233","UBUNTU-CVE-2016-2085","USN-2946-1","USN-2947-2","USN-2948-1","USN-2949-1"],"status":"published","title":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5...","description":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0046,"percentile":0.40154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-19"],"published":"2016-02-15T00:00:00Z","modified":"2026-09-22T07:03:03Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.4.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.4.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-85.129"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","fixed_in":["3.16.0-69.89~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","fixed_in":["3.19.0-58.64~14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","fixed_in":["4.2.0-35.40~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"dracut","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"038-21.mga5"}]}],"bundled":18},{"source":"osv","ecosystem":"Mageia:5","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-1.mga5"}]}],"bundled":18},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-1.mga5"}]}],"bundled":18},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.16-6.mga5"}]}],"bundled":18},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.16-6.mga5"}]}],"bundled":18},{"source":"osv","ecosystem":"Mageia:5","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10-7.mga5"}]}],"bundled":18},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-1.mga5"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:5","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.13-1.mga5"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-85.129"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-69.89~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1","3.16.0-43.58~14.04.1","3.16.0-44.59~14.04.1","3.16.0-45.60~14.04.1","3.16.0-46.62~14.04.1","3.16.0-48.64~14.04.1","3.16.0-49.65~14.04.1","3.16.0-50.66~14.04.1","3.16.0-50.67~14.04.1","3.16.0-51.69~14.04.1","3.16.0-52.71~14.04.1","3.16.0-53.72~14.04.1","3.16.0-55.74~14.04.1","3.16.0-56.75~14.04.1","3.16.0-57.77~14.04.1","3.16.0-59.79~14.04.1","3.16.0-60.80~14.04.1","3.16.0-62.82~14.04.1","3.16.0-62.83~14.04.1","3.16.0-67.87~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-58.64~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1","3.19.0-49.55~14.04.1","3.19.0-51.57~14.04.1","3.19.0-51.58~14.04.1","3.19.0-56.62~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-35.40~14.04.1"}]}],"versions":["4.2.0-18.22~14.04.1","4.2.0-19.23~14.04.1","4.2.0-21.25~14.04.1","4.2.0-22.27~14.04.1","4.2.0-23.28~14.04.1","4.2.0-25.30~14.04.1","4.2.0-27.32~14.04.1","4.2.0-30.35~14.04.1","4.2.0-30.36~14.04.1","4.2.0-34.39~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-85.129"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88","3.13.0-53.89","3.13.0-54.91","3.13.0-55.92","3.13.0-55.94","3.13.0-57.95","3.13.0-58.97","3.13.0-59.98","3.13.0-61.100","3.13.0-62.102","3.13.0-63.103","3.13.0-65.105","3.13.0-65.106","3.13.0-66.108","3.13.0-67.110","3.13.0-68.111","3.13.0-70.113","3.13.0-71.114","3.13.0-73.116","3.13.0-74.118","3.13.0-76.120","3.13.0-77.121","3.13.0-79.123","3.13.0-83.127"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-wily","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-35.40~14.04.1"}]}],"versions":["4.2.0-18.22~14.04.1","4.2.0-19.23~14.04.1","4.2.0-21.25~14.04.1","4.2.0-22.27~14.04.1","4.2.0-23.28~14.04.1","4.2.0-25.30~14.04.1","4.2.0-27.32~14.04.1","4.2.0-30.35~14.04.1","4.2.0-30.36~14.04.1","4.2.0-34.39~14.04.1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-69.89~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1","3.16.0-38.52~14.04.1","3.16.0-39.53~14.04.1","3.16.0-40.54~14.04.1","3.16.0-41.55~14.04.1","3.16.0-41.57~14.04.1","3.16.0-43.58~14.04.1","3.16.0-44.59~14.04.1","3.16.0-45.60~14.04.1","3.16.0-46.62~14.04.1","3.16.0-48.64~14.04.1","3.16.0-49.65~14.04.1","3.16.0-50.66~14.04.1","3.16.0-50.67~14.04.1","3.16.0-51.69~14.04.1","3.16.0-52.71~14.04.1","3.16.0-53.72~14.04.1","3.16.0-55.74~14.04.1","3.16.0-56.75~14.04.1","3.16.0-57.77~14.04.1","3.16.0-59.79~14.04.1","3.16.0-60.80~14.04.1","3.16.0-62.82~14.04.1","3.16.0-62.83~14.04.1","3.16.0-67.87~14.04.1"],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-vivid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-58.64~14.04.1"}]}],"versions":["3.19.0-18.18~14.04.1","3.19.0-20.20~14.04.1","3.19.0-21.21~14.04.1","3.19.0-22.22~14.04.1","3.19.0-23.24~14.04.1","3.19.0-25.26~14.04.1","3.19.0-26.28~14.04.1","3.19.0-28.30~14.04.1","3.19.0-30.33~14.04.1","3.19.0-30.34~14.04.1","3.19.0-31.36~14.04.1","3.19.0-32.37~14.04.1","3.19.0-33.38~14.04.1","3.19.0-37.42~14.04.1","3.19.0-39.44~14.04.1","3.19.0-41.46~14.04.2","3.19.0-42.48~14.04.1","3.19.0-43.49~14.04.1","3.19.0-47.53~14.04.1","3.19.0-49.55~14.04.1","3.19.0-51.57~14.04.1","3.19.0-51.58~14.04.1","3.19.0-56.62~14.04.1"],"bundled":4}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2949-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1324867","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2085","tags":["x_refsource_CONFIRM","x_transferred","web","advisory"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=613317bd212c585c20796c10afe5daaa95d4b0a1","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2947-3","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2947-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-2085.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2947-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2946-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://github.com/torvalds/linux/commit/613317bd212c585c20796c10afe5daaa95d4b0a1","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"http://www.ubuntu.com/usn/USN-2948-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2946-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2948-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2085"},{"url":"https://github.com/advisories/GHSA-w99v-p99f-6f3g"},{"url":"https://advisories.mageia.org/MGASA-2016-0225.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18688","tags":["report"]},{"url":"http://kernelnewbies.org/Linux_4.2","tags":["web"]},{"url":"http://kernelnewbies.org/Linux_4.3","tags":["web"]},{"url":"http://kernelnewbies.org/Linux_4.4","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.1","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.2","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.3","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.4","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.5","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.6","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.7","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.8","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.9","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.10","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.11","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.12","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.13","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2016-0232.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18374","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2016-0233.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18375","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2085","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2946-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2946-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2947-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2947-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2947-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2948-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2949-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2085","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-8812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7833","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-0723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2782","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-2085","description":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.","status":"published","published":"2016-04-27T17:00:00Z","modified":"2024-08-05T23:17:50.339Z","updated_at":"2026-11-02T14:33:33.424551Z"}],"euvd":[{"id":"EUVD-2016-3190","description":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.","status":"published","published":"2016-04-27T17:00:00Z","modified":"2024-08-05T23:17:50Z","updated_at":"2026-11-03T02:22:54.667958Z"}],"ghsa":[{"id":"GHSA-w99v-p99f-6f3g","title":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5...","description":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.","status":"published","published":"2022-05-17T03:31:18Z","modified":"2023-01-27T05:08:29Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:43:18.355701Z"}],"nvd":[{"id":"CVE-2016-2085","description":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.","status":"published","published":"2016-04-27T17:59:07.977Z","modified":"2026-06-17T00:43:24.553Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-19"],"updated_at":"2026-11-02T14:03:23.795791Z"}],"osv":[{"id":"CVE-2016-2085","description":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.","status":"published","published":"2016-04-27T17:59:07.977Z","modified":"2026-04-16T06:25:23.588373946Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2085","description":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.","status":"published","published":"2016-04-27T17:59:07.977Z","modified":"2026-09-22T07:03:03.876768214Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-2085","description":"The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.","status":"published","published":"2016-02-15T00:00:00Z","modified":"2026-04-22T10:35:51.756259Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"MGASA-2016-0225","title":"Updated kernel packages fix security vulnerabilities","description":"This kernel update provides an upgrade to the upstream 4.4 longterm kernel\nseries, currently based on 4.4.13 and resolves at least the following\nsecurity issues:\n\nThe Linux kernel before 4.4.1 allows local users to bypass file-descriptor\nlimits and cause a denial of service (memory consumption) by sending each\ndescriptor over a UNIX socket before closing it, related to \nnet/unix/af_unix.c and net/unix/garbage.c (CVE-2013-4312).\n\ndrivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows\nphysically proximate attackers to cause a denial of service (NULL pointer\ndereference and OOPS) or possibly have unspecified other impact via a\ncrafted USB device (CVE-2015-5257).\n\nThe KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through\n4.6.x, allows guest OS users to cause a denial of service (host OS panic or\nhang) by triggering many #AC (aka Alignment Check) exceptions, related to\nsvm.c and vmx.c (CVE-2015-5307).\n\nAn out-of-bounds memory read was found, affecting kernels from 4.3-rc1\nonwards. This vulnerability was caused by incorrect X.509 time validation\nin x509_decode_time() function in x509_cert_parser.c (CVE-2015-5327).\n\nThe __rds_conn_create function in net/rds/connection.c in the Linux kernel\nthrough 4.2.3 allows local users to cause a denial of service (NULL pointer\ndereference and system crash) or possibly have unspecified other impact by\nusing a socket that was not properly bound (CVE-2015-6937).\n\nThe keyctl_read_key function in security/keys/keyctl.c in the Linux kernel\nbefore 4.3.4 does not properly use a semaphore, which allows local users\nto cause a denial of service (NULL pointer dereference and system crash)\nor possibly have unspecified other impact via a crafted application that\nleverages a race condition between keyctl_revoke and keyctl_read calls\n(CVE-2015-7550).\n\nThe slhc_init function in drivers/net/slip/slhc.c in the Linux kernel\nthrough 4.2.3 does not ensure that certain slot numbers are valid, which\nallows local users to cause a denial of service (NULL pointer dereference\nand system crash) via a crafted PPPIOCSMAXCID ioctl call (CVE-2015-7799).\n\nThe KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through\n4.6.x, allows guest OS users to cause a denial of service (host OS panic\nor hang) by triggering many #DB (aka Debug) exceptions, related to svm.c\n(CVE-2015-8104).\n\nThe networking implementation in the Linux kernel through 4.3.3, as used\nin Android and other products, does not validate protocol identifiers for\ncertain protocol families, which allows local users to cause a denial of\nservice (NULL function pointer dereference and system crash) or possibly\ngain privileges by leveraging CLONE_NEWUSER support to execute a crafted\nSOCK_RAW application (CVE-2015-8543).\n\nAn issue with ASN.1 DER decoder was reported that could lead to memory\ncorruptions, possible privilege escalation, or complete local denial\nof service via x509 certificate DER files (CVE-2016-0758).\n\nThe evm_verify_hmac function in security/integrity/evm/evm_main.c in the\nLinux kernel before 4.5 does not properly copy data, which makes it easier\nfor local users to forge MAC values via a timing side-channel attack\n(CVE-2016-2085).\n\nThe atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the\nLinux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which\nallows remote attackers to obtain sensitive information from kernel memory\nby reading packet data (CVE-2016-2117).\n\nThe mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the\nLinux kernel before 4.5.1 allows physically proximate attackers to cause a\ndenial of service (NULL pointer dereference and system crash) via a crafted\nUSB device without two interrupt-in endpoint descriptors (CVE-2016-3136).\n\ndrivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows\nphysically proximate attackers to cause a denial of service (NULL pointer\ndereference and system crash) via a USB device without both an interrupt-in\nand an interrupt-out endpoint descriptor, related to the\ncypress_generic_port_probe and cypress_open functions (CVE-2016-3137).\n\nThe arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux\nkernel through 4.5.2 does not properly randomize the legacy base address,\nwhich makes it easier for local users to defeat the intended restrictions\non the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism\nfor a setuid or setgid program, by disabling stack-consumption resource\nlimits (CVE-2016-3672).\n\nLinux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) with\nvariable Memory Type Range Registers(MTRR) support is vulnerable to an\nout-of-bounds r/w access issue. It could occur while accessing processors\nMTRRs via ioctl(2) calls. A privileged user inside guest could use this\nflaw to manipulate host kernels memory bytes leading to information\ndisclosure OR potentially crashing the kernel resulting in DoS\n(CVE-2016-3713).\n\nXen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs\nsupport in x86 PV guests, which allows local PV guest users to cause a\ndenial of service (guest OS crash) by attempting to access a hugetlbfs\nmapped area (CVE-2016-3961).\n\nThe server kernels have been switched from SLAB to SLUB memory allocator as\nit performs better under high memory pressure for most users.\n\nThis update also provides better support for various newer hardware.\n\nFor other changes in this update, see the referenced changelogs.\n","status":"published","published":"2016-06-13T15:55:41Z","modified":"2026-04-16T06:22:24.493864674Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2016-0232","title":"Updated kernel-linus packages fix security vulnerabilities","description":"This kernel-linus update provides an upgrade to the upstream 4.4 longterm\nkernel series, currently based on 4.4.13 and resolves at least the following\nsecurity issues:\n\nThe Linux kernel before 4.4.1 allows local users to bypass file-descriptor\nlimits and cause a denial of service (memory consumption) by sending each\ndescriptor over a UNIX socket before closing it, related to \nnet/unix/af_unix.c and net/unix/garbage.c (CVE-2013-4312).\n\ndrivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows\nphysically proximate attackers to cause a denial of service (NULL pointer\ndereference and OOPS) or possibly have unspecified other impact via a\ncrafted USB device (CVE-2015-5257).\n\nThe KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through\n4.6.x, allows guest OS users to cause a denial of service (host OS panic or\nhang) by triggering many #AC (aka Alignment Check) exceptions, related to\nsvm.c and vmx.c (CVE-2015-5307).\n\nAn out-of-bounds memory read was found, affecting kernels from 4.3-rc1\nonwards. This vulnerability was caused by incorrect X.509 time validation\nin x509_decode_time() function in x509_cert_parser.c (CVE-2015-5327).\n\nThe __rds_conn_create function in net/rds/connection.c in the Linux kernel\nthrough 4.2.3 allows local users to cause a denial of service (NULL pointer\ndereference and system crash) or possibly have unspecified other impact by\nusing a socket that was not properly bound (CVE-2015-6937).\n\nThe keyctl_read_key function in security/keys/keyctl.c in the Linux kernel\nbefore 4.3.4 does not properly use a semaphore, which allows local users\nto cause a denial of service (NULL pointer dereference and system crash)\nor possibly have unspecified other impact via a crafted application that\nleverages a race condition between keyctl_revoke and keyctl_read calls\n(CVE-2015-7550).\n\nThe slhc_init function in drivers/net/slip/slhc.c in the Linux kernel\nthrough 4.2.3 does not ensure that certain slot numbers are valid, which\nallows local users to cause a denial of service (NULL pointer dereference\nand system crash) via a crafted PPPIOCSMAXCID ioctl call (CVE-2015-7799).\n\nThe KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through\n4.6.x, allows guest OS users to cause a denial of service (host OS panic\nor hang) by triggering many #DB (aka Debug) exceptions, related to svm.c\n(CVE-2015-8104).\n\nThe networking implementation in the Linux kernel through 4.3.3, as used\nin Android and other products, does not validate protocol identifiers for\ncertain protocol families, which allows local users to cause a denial of\nservice (NULL function pointer dereference and system crash) or possibly\ngain privileges by leveraging CLONE_NEWUSER support to execute a crafted\nSOCK_RAW application (CVE-2015-8543).\n\nThe evm_verify_hmac function in security/integrity/evm/evm_main.c in the\nLinux kernel before 4.5 does not properly copy data, which makes it easier\nfor local users to forge MAC values via a timing side-channel attack\n(CVE-2016-2085).\n\nThe atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the\nLinux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which\nallows remote attackers to obtain sensitive information from kernel memory\nby reading packet data (CVE-2016-2117).\n\nThe mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the\nLinux kernel before 4.5.1 allows physically proximate attackers to cause a\ndenial of service (NULL pointer dereference and system crash) via a crafted\nUSB device without two interrupt-in endpoint descriptors (CVE-2016-3136).\n\ndrivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows\nphysically proximate attackers to cause a denial of service (NULL pointer\ndereference and system crash) via a USB device without both an interrupt-in\nand an interrupt-out endpoint descriptor, related to the\ncypress_generic_port_probe and cypress_open functions (CVE-2016-3137).\n\nLinux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) with\nvariable Memory Type Range Registers(MTRR) support is vulnerable to an\nout-of-bounds r/w access issue. It could occur while accessing processors\nMTRRs via ioctl(2) calls. A privileged user inside guest could use this\nflaw to manipulate host kernels memory bytes leading to information\ndisclosure OR potentially crashing the kernel resulting in DoS\n(CVE-2016-3713).\n\nXen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs\nsupport in x86 PV guests, which allows local PV guest users to cause a\ndenial of service (guest OS crash) by attempting to access a hugetlbfs\nmapped area (CVE-2016-3961).\n\nThis update also provides better support for various newer hardware.\n\nFor other changes in this update, see the referenced changelogs.\n","status":"published","published":"2016-06-22T19:08:04Z","modified":"2026-04-16T06:24:16.33192183Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2016-0233","title":"Updated kernel-tmb packages fix security vulnerabilities","description":"This kernel-tmb update provides an upgrade to the upstream 4.4 longterm\nkernel series, currently based on 4.4.13 and resolves at least the following\nsecurity issues:\n\nThe Linux kernel before 4.4.1 allows local users to bypass file-descriptor\nlimits and cause a denial of service (memory consumption) by sending each\ndescriptor over a UNIX socket before closing it, related to \nnet/unix/af_unix.c and net/unix/garbage.c (CVE-2013-4312).\n\ndrivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows\nphysically proximate attackers to cause a denial of service (NULL pointer\ndereference and OOPS) or possibly have unspecified other impact via a\ncrafted USB device (CVE-2015-5257).\n\nThe KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through\n4.6.x, allows guest OS users to cause a denial of service (host OS panic or\nhang) by triggering many #AC (aka Alignment Check) exceptions, related to\nsvm.c and vmx.c (CVE-2015-5307).\n\nAn out-of-bounds memory read was found, affecting kernels from 4.3-rc1\nonwards. This vulnerability was caused by incorrect X.509 time validation\nin x509_decode_time() function in x509_cert_parser.c (CVE-2015-5327).\n\nThe __rds_conn_create function in net/rds/connection.c in the Linux kernel\nthrough 4.2.3 allows local users to cause a denial of service (NULL pointer\ndereference and system crash) or possibly have unspecified other impact by\nusing a socket that was not properly bound (CVE-2015-6937).\n\nThe keyctl_read_key function in security/keys/keyctl.c in the Linux kernel\nbefore 4.3.4 does not properly use a semaphore, which allows local users\nto cause a denial of service (NULL pointer dereference and system crash)\nor possibly have unspecified other impact via a crafted application that\nleverages a race condition between keyctl_revoke and keyctl_read calls\n(CVE-2015-7550).\n\nThe slhc_init function in drivers/net/slip/slhc.c in the Linux kernel\nthrough 4.2.3 does not ensure that certain slot numbers are valid, which\nallows local users to cause a denial of service (NULL pointer dereference\nand system crash) via a crafted PPPIOCSMAXCID ioctl call (CVE-2015-7799).\n\nThe KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through\n4.6.x, allows guest OS users to cause a denial of service (host OS panic\nor hang) by triggering many #DB (aka Debug) exceptions, related to svm.c\n(CVE-2015-8104).\n\nThe networking implementation in the Linux kernel through 4.3.3, as used\nin Android and other products, does not validate protocol identifiers for\ncertain protocol families, which allows local users to cause a denial of\nservice (NULL function pointer dereference and system crash) or possibly\ngain privileges by leveraging CLONE_NEWUSER support to execute a crafted\nSOCK_RAW application (CVE-2015-8543).\n\nAn issue with ASN.1 DER decoder was reported that could lead to memory\ncorruptions, possible privilege escalation, or complete local denial\nof service via x509 certificate DER files (CVE-2016-0758).\n\nThe evm_verify_hmac function in security/integrity/evm/evm_main.c in the\nLinux kernel before 4.5 does not properly copy data, which makes it easier\nfor local users to forge MAC values via a timing side-channel attack\n(CVE-2016-2085).\n\nThe atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the\nLinux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which\nallows remote attackers to obtain sensitive information from kernel memory\nby reading packet data (CVE-2016-2117).\n\nThe mct_u232_msr_to_state function in drivers/usb/serial/mct_u232.c in the\nLinux kernel before 4.5.1 allows physically proximate attackers to cause a\ndenial of service (NULL pointer dereference and system crash) via a crafted\nUSB device without two interrupt-in endpoint descriptors (CVE-2016-3136).\n\ndrivers/usb/serial/cypress_m8.c in the Linux kernel before 4.5.1 allows\nphysically proximate attackers to cause a denial of service (NULL pointer\ndereference and system crash) via a USB device without both an interrupt-in\nand an interrupt-out endpoint descriptor, related to the\ncypress_generic_port_probe and cypress_open functions (CVE-2016-3137).\n\nThe arch_pick_mmap_layout function in arch/x86/mm/mmap.c in the Linux\nkernel through 4.5.2 does not properly randomize the legacy base address,\nwhich makes it easier for local users to defeat the intended restrictions\non the ADDR_NO_RANDOMIZE flag, and bypass the ASLR protection mechanism\nfor a setuid or setgid program, by disabling stack-consumption resource\nlimits (CVE-2016-3672).\n\nLinux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) with\nvariable Memory Type Range Registers(MTRR) support is vulnerable to an\nout-of-bounds r/w access issue. It could occur while accessing processors\nMTRRs via ioctl(2) calls. A privileged user inside guest could use this\nflaw to manipulate host kernels memory bytes leading to information\ndisclosure OR potentially crashing the kernel resulting in DoS\n(CVE-2016-3713).\n\nXen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs\nsupport in x86 PV guests, which allows local PV guest users to cause a\ndenial of service (guest OS crash) by attempting to access a hugetlbfs\nmapped area (CVE-2016-3961).\n\nThis update also provides better support for various newer hardware.\n\nFor other changes in this update, see the referenced changelogs.\n","status":"published","published":"2016-06-22T19:08:04Z","modified":"2026-04-16T06:22:25.413451429Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"USN-2946-1","title":"linux vulnerabilities","description":"Venkatesh Pottem discovered a use-after-free vulnerability in the Linux\nkernel's CXGB3 driver. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code. (CVE-2015-8812)\n\nXiaofei Rex Guo discovered a timing side channel vulnerability in the Linux\nExtended Verification Module (EVM). An attacker could use this to affect\nsystem integrity. (CVE-2016-2085)\n\nDavid Herrmann discovered that the Linux kernel incorrectly accounted file\ndescriptors to the original opener for in-flight file descriptors sent over\na unix domain socket. A local attacker could use this to cause a denial of\nservice (resource exhaustion). (CVE-2016-2550)\n\nIt was discovered that the Linux kernel did not enforce limits on the\namount of data allocated to buffer pipes. A local attacker could use this\nto cause a denial of service (resource exhaustion). (CVE-2016-2847)\n","status":"published","published":"2016-04-06T06:38:00Z","modified":"2026-04-22T09:23:36.783718Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-2947-2","title":"linux-lts-wily vulnerabilities","description":"Ralf Spenneberg discovered that the usbvision driver in the Linux kernel\ndid not properly validate the interfaces and endpoints reported by the\ndevice. An attacker with physical access could cause a denial of service\n(system crash). (CVE-2015-7833)\n\nVenkatesh Pottem discovered a use-after-free vulnerability in the Linux\nkernel's CXGB3 driver. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code. (CVE-2015-8812)\n\nXiaofei Rex Guo discovered a timing side channel vulnerability in the Linux\nExtended Verification Module (EVM). An attacker could use this to affect\nsystem integrity. (CVE-2016-2085)\n\nIt was discovered that the extended Berkeley Packet Filter (eBPF)\nimplementation in the Linux kernel did not correctly compute branch offsets\nfor backward jumps after ctx expansion. A local attacker could use this to\ncause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2016-2383)\n\nDavid Herrmann discovered that the Linux kernel incorrectly accounted file\ndescriptors to the original opener for in-flight file descriptors sent over\na unix domain socket. A local attacker could use this to cause a denial of\nservice (resource exhaustion). (CVE-2016-2550)\n\nIt was discovered that the Linux kernel did not enforce limits on the\namount of data allocated to buffer pipes. A local attacker could use this\nto cause a denial of service (resource exhaustion). (CVE-2016-2847)\n","status":"published","published":"2016-04-06T06:59:29Z","modified":"2026-02-10T04:40:58Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-2948-1","title":"linux-lts-utopic vulnerabilities","description":"Ralf Spenneberg discovered that the USB driver for Clie devices in the\nLinux kernel did not properly validate the endpoints reported by the\ndevice. An attacker with physical access could cause a denial of service\n(system crash). (CVE-2015-7566)\n\nRalf Spenneberg discovered that the usbvision driver in the Linux kernel\ndid not properly validate the interfaces and endpoints reported by the\ndevice. An attacker with physical access could cause a denial of service\n(system crash). (CVE-2015-7833)\n\nVenkatesh Pottem discovered a use-after-free vulnerability in the Linux\nkernel's CXGB3 driver. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code. (CVE-2015-8812)\n\nIt was discovered that a race condition existed in the ioctl handler for\nthe TTY driver in the Linux kernel. A local attacker could use this to\ncause a denial of service (system crash) or expose sensitive information.\n(CVE-2016-0723)\n\nXiaofei Rex Guo discovered a timing side channel vulnerability in the Linux\nExtended Verification Module (EVM). An attacker could use this to affect\nsystem integrity. (CVE-2016-2085)\n\nDavid Herrmann discovered that the Linux kernel incorrectly accounted file\ndescriptors to the original opener for in-flight file descriptors sent over\na unix domain socket. A local attacker could use this to cause a denial of\nservice (resource exhaustion). (CVE-2016-2550)\n\nRalf Spenneberg discovered that the USB driver for Treo devices in the\nLinux kernel did not properly validate the endpoints reported by the\ndevice. An attacker with physical access could cause a denial of service\n(system crash). (CVE-2016-2782)\n\nIt was discovered that the Linux kernel did not enforce limits on the\namount of data allocated to buffer pipes. A local attacker could use this\nto cause a denial of service (resource exhaustion). (CVE-2016-2847)\n","status":"published","published":"2016-04-06T07:35:26Z","modified":"2026-02-10T04:40:58Z","updated_at":"2026-11-02T16:58:10.303275Z"},{"id":"USN-2949-1","title":"linux-lts-vivid vulnerabilities","description":"Venkatesh Pottem discovered a use-after-free vulnerability in the Linux\nkernel's CXGB3 driver. A local attacker could use this to cause a denial of\nservice (system crash) or possibly execute arbitrary code. (CVE-2015-8812)\n\nXiaofei Rex Guo discovered a timing side channel vulnerability in the Linux\nExtended Verification Module (EVM). An attacker could use this to affect\nsystem integrity. (CVE-2016-2085)\n\nDavid Herrmann discovered that the Linux kernel incorrectly accounted file\ndescriptors to the original opener for in-flight file descriptors sent over\na unix domain socket. A local attacker could use this to cause a denial of\nservice (resource exhaustion). (CVE-2016-2550)\n\nIt was discovered that the Linux kernel did not enforce limits on the\namount of data allocated to buffer pipes. A local attacker could use this\nto cause a denial of service (resource exhaustion). (CVE-2016-2847)\n","status":"published","published":"2016-04-06T07:53:51Z","modified":"2026-02-10T04:40:58Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}