{"id":"CVE-2016-8636","aliases":["DEBIAN-CVE-2016-8636","EUVD-2016-9479","GHSA-vv9c-r5jj-58f9","SUSE-SU-2019:1287-1","UBUNTU-CVE-2016-8636","USN-3361-1"],"status":"published","title":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the...","description":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the \"RDMA protocol over infiniband\" (aka Soft RoCE) technology.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01152,"percentile":0.6718,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-190"],"published":"2017-02-22T00:00:00Z","modified":"2026-09-22T07:02:32Z","exploits":[{"source":"pocgithub","id":"jigerjain/Integer-Overflow-test","title":"jigerjain/Integer-Overflow-test","date":"2018-12-11","url":"https://github.com/jigerjain/Integer-Overflow-test"}],"fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["4.9.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["4.9.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["4.9.10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","fixed_in":["4.10.0-32.36~16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.10-1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"kgraft-patch-SLE12-SP2_Update_29","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-3.5.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 12 SP2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"kgraft-patch-SLE12-SP2_Update_29","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-3.5.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"kgraft-patch-SLE12-SP2_Update_29","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-3.5.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.121-92.109.2"}]}],"bundled":16},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"kgraft-patch-SLE12-SP2_Update_29","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-3.5.2"}]}],"bundled":16},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-32.36~16.04.1"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1","4.10.0-27.30~16.04.2","4.10.0-28.32~16.04.2","4.10.0-30.34~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.0-27.30~16.04.2"}]}],"versions":["4.8.0-36.36~16.04.1","4.8.0-39.42~16.04.1","4.8.0-41.44~16.04.1","4.8.0-42.45~16.04.1","4.8.0-44.47~16.04.1","4.8.0-45.48~16.04.1","4.8.0-46.49~16.04.1","4.8.0-49.52~16.04.1","4.8.0-51.54~16.04.1","4.8.0-52.55~16.04.1","4.8.0-53.56~16.04.1","4.8.0-54.57~16.04.1","4.8.0-56.61~16.04.1","4.8.0-58.63~16.04.1"],"bundled":40}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.securityfocus.com/bid/96189","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/02/11/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.10","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://eyalitkin.wordpress.com/2017/02/11/cve-publication-cve-2016-8636/","tags":["x_refsource_MISC","x_transferred","Patch","Technical Description","Third Party Advisory","fix"]},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=647bf3d8a8e5777319da92af672289b2a6c4dc66","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1421981","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://github.com/torvalds/linux/commit/647bf3d8a8e5777319da92af672289b2a6c4dc66","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8636"},{"url":"https://eyalitkin.wordpress.com/2017/02/11/cve-publication-cve-2016-8636"},{"url":"https://github.com/advisories/GHSA-vv9c-r5jj-58f9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-8636","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20191287-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1012382","tags":["report"]},{"url":"https://bugzilla.suse.com/1024908","tags":["report"]},{"url":"https://bugzilla.suse.com/1034113","tags":["report"]},{"url":"https://bugzilla.suse.com/1043485","tags":["report"]},{"url":"https://bugzilla.suse.com/1068032","tags":["report"]},{"url":"https://bugzilla.suse.com/1073311","tags":["report"]},{"url":"https://bugzilla.suse.com/1080157","tags":["report"]},{"url":"https://bugzilla.suse.com/1080533","tags":["report"]},{"url":"https://bugzilla.suse.com/1082632","tags":["report"]},{"url":"https://bugzilla.suse.com/1087231","tags":["report"]},{"url":"https://bugzilla.suse.com/1087659","tags":["report"]},{"url":"https://bugzilla.suse.com/1087906","tags":["report"]},{"url":"https://bugzilla.suse.com/1093158","tags":["report"]},{"url":"https://bugzilla.suse.com/1094268","tags":["report"]},{"url":"https://bugzilla.suse.com/1096748","tags":["report"]},{"url":"https://bugzilla.suse.com/1100152","tags":["report"]},{"url":"https://bugzilla.suse.com/1103186","tags":["report"]},{"url":"https://bugzilla.suse.com/1106913","tags":["report"]},{"url":"https://bugzilla.suse.com/1109772","tags":["report"]},{"url":"https://bugzilla.suse.com/1111331","tags":["report"]},{"url":"https://bugzilla.suse.com/1112178","tags":["report"]},{"url":"https://bugzilla.suse.com/1113399","tags":["report"]},{"url":"https://bugzilla.suse.com/1116841","tags":["report"]},{"url":"https://bugzilla.suse.com/1118338","tags":["report"]},{"url":"https://bugzilla.suse.com/1119019","tags":["report"]},{"url":"https://bugzilla.suse.com/1122822","tags":["report"]},{"url":"https://bugzilla.suse.com/1124832","tags":["report"]},{"url":"https://bugzilla.suse.com/1125580","tags":["report"]},{"url":"https://bugzilla.suse.com/1129279","tags":["report"]},{"url":"https://bugzilla.suse.com/1131416","tags":["report"]},{"url":"https://bugzilla.suse.com/1131427","tags":["report"]},{"url":"https://bugzilla.suse.com/1131587","tags":["report"]},{"url":"https://bugzilla.suse.com/1132673","tags":["report"]},{"url":"https://bugzilla.suse.com/1132828","tags":["report"]},{"url":"https://bugzilla.suse.com/1133188","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11091","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9503","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-8636","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3361-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-8405","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9084","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9191","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9604","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9755","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2583","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5546","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5549","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5550","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5551","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5576","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5897","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-5970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6001","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6214","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6346","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6347","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-6348","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7187","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7261","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7273","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7472","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7616","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7645","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7889","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-7895","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8924","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-8925","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-9150","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-8636","description":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the \"RDMA protocol over infiniband\" (aka Soft RoCE) technology.","status":"published","published":"2017-02-22T16:00:00Z","modified":"2024-08-06T02:27:41.119Z","updated_at":"2026-11-02T14:33:32.415289Z"}],"euvd":[{"id":"EUVD-2016-9479","description":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the \"RDMA protocol over infiniband\" (aka Soft RoCE) technology.","status":"published","published":"2017-02-22T16:00:00Z","modified":"2024-08-06T02:27:41Z","updated_at":"2026-11-03T02:22:29.639634Z"}],"ghsa":[{"id":"GHSA-vv9c-r5jj-58f9","title":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the...","description":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the \"RDMA protocol over infiniband\" (aka Soft RoCE) technology.","status":"published","published":"2022-05-17T02:57:32Z","modified":"2025-04-20T03:34:26Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:01:41.934315Z"}],"nvd":[{"id":"CVE-2016-8636","description":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the \"RDMA protocol over infiniband\" (aka Soft RoCE) technology.","status":"published","published":"2017-02-22T16:59:00.193Z","modified":"2026-06-17T00:54:39.33Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:03:35.822579Z"}],"osv":[{"id":"CVE-2016-8636","description":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the \"RDMA protocol over infiniband\" (aka Soft RoCE) technology.","status":"published","published":"2017-02-22T16:59:00.193Z","modified":"2026-03-15T14:23:15.775782Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:03.171316Z"},{"id":"DEBIAN-CVE-2016-8636","description":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the \"RDMA protocol over infiniband\" (aka Soft RoCE) technology.","status":"published","published":"2017-02-22T16:59:00.193Z","modified":"2026-09-22T07:02:32.291747392Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"UBUNTU-CVE-2016-8636","description":"Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c in the Linux kernel before 4.9.10 allows local users to cause a denial of service (memory corruption), obtain sensitive information from kernel memory, or possibly have unspecified other impact via a write or read request involving the \"RDMA protocol over infiniband\" (aka Soft RoCE) technology.","status":"published","published":"2017-02-22T00:00:00Z","modified":"2026-02-04T02:49:21.843512Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"SUSE-SU-2019:1287-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 12 SP2 kernel was updated to receive various security and bugfixes.\n\nFour new speculative execution information leak issues have been identified in Intel CPUs. (bsc#1111331)\n\n- CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)\n- CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)\n- CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)\n- CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)\n\nThis kernel update contains software mitigations for these issues, which also utilize CPU microcode updates shipped in parallel.\n\nFor more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736\n\nThe following security bugs were fixed:\n\n- CVE-2018-1128: It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network could use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. (bnc#1096748).\n- CVE-2018-1129: A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. (bnc#1096748).\n- CVE-2016-8636: Integer overflow in the mem_check_range function in drivers/infiniband/sw/rxe/rxe_mr.c allowed local users to cause a denial of service (memory corruption), obtain sensitive information or possibly have unspecified other impact via a write or read request involving the 'RDMA protocol over infiniband' (aka Soft RoCE) technology (bnc#1024908).\n- CVE-2017-18174: In the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free (bnc#1080533).\n- CVE-2018-1091: In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service (bnc#1087231).\n- CVE-2018-1120: By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or environment strings), an attacker can cause utilities from psutils or procps (such as ps, w) or any other program which made a read() call to the /proc/\u003cpid\u003e/cmdline (or /proc/\u003cpid\u003e/environ) files to block indefinitely (denial of service) or for some controlled time (as a synchronization primitive for other attacks) (bnc#1093158).\n- CVE-2019-11486: The Siemens R3964 line discipline driver in drivers/tty/n_r3964.c has multiple race conditions (bnc#1133188).\n- CVE-2019-3882: A flaw was found in the vfio interface implementation that permits violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS) (bsc#1131427).\n- CVE-2018-19407: The vcpu_scan_ioapic function in arch/x86/kvm/x86.c allowed local users to cause a denial of service (NULL pointer dereference and BUG) via crafted system calls that reach a situation where ioapic is uninitialized (bnc#1116841).\n- CVE-2017-17741: The KVM implementation allowed attackers to obtain potentially sensitive information from kernel memory, aka a write_mmio stack-based out-of-bounds read, related to arch/x86/kvm/x86.c and include/trace/events/kvm.h (bnc#1073311).\n- CVE-2019-9503, CVE-2019-8564: Multiple brcmfmac frame validation bypasses have been fixed (bnc#1132828, bnc#1132673).\n\nThe following non-security bugs were fixed:\n\n- ACPI: acpi_pad: Do not launch acpi_pad threads on idle cpus (bsc#1113399).\n- add mainline tags to four hyperv patches\n- cpu/speculation: Add 'mitigations=' cmdline option (bsc#1112178).\n- Drivers: hv: vmbus: Define an API to retrieve virtual processor index (bsc#1122822).\n- Drivers: hv: vmbus: Define APIs to manipulate the event page (bsc#1122822).\n- Drivers: hv: vmbus: Define APIs to manipulate the message page (bsc#1122822).++ kernel-source.spec (revision 4)Release:    \u0026lt;RELEASE\u003e.gbd4498d\n- Drivers: hv: vmbus: Define APIs to manipulate the synthetic interrupt controller (bsc#1122822).\n- hv: v4.12 API for hyperv-iommu (bsc#1122822).\n- iommu/hyper-v: Add Hyper-V stub IOMMU driver (bsc#1122822).\n- jump_label: remove bug.h, atomic.h dependencies for HAVE_JUMP_LABEL (bsc#1111331).\n- kvm: x86: Report STIBP on GET_SUPPORTED_CPUID (bsc#1111331).\n- locking/atomics, asm-generic: Move some macros from \u003clinux/bitops.h\u003e to a new \u003clinux/bits.h\u003e file (bsc#1111331).\n- MDS: Add CVE refs\n- net: ena: add functions for handling Low Latency Queues in ena_com (bsc#1129279).\n- net: ena: add functions for handling Low Latency Queues in ena_netdev (bsc#1129279).\n- net: ena: change rx copybreak default to reduce kernel memory pressure (bsc#1129279).\n- net: ena: complete host info to match latest ENA spec (bsc#1129279).\n- net: ena: enable Low Latency Queues (bsc#1129279).\n- net: ena: explicit casting and initialization, and clearer error handling (bsc#1129279).\n- net: ena: fix auto casting to boolean (bsc#1129279).\n- net: ena: fix compilation error in xtensa architecture (bsc#1129279).\n- net: ena: fix crash during ena_remove() (bsc#1129279).\n- net: ena: fix crash during failed resume from hibernation (bsc#1129279).\n- net: ena: fix indentations in ena_defs for better readability (bsc#1129279).\n- net: ena: Fix Kconfig dependency on X86 (bsc#1129279).\n- net: ena: fix NULL dereference due to untimely napi initialization (bsc#1129279).\n- net: ena: fix race between link up and device initalization (bsc#1129279).\n- net: ena: fix rare bug when failed restart/resume is followed by driver removal (bsc#1129279).\n- net: ena: fix warning in rmmod caused by double iounmap (bsc#1129279).\n- net: ena: introduce Low Latency Queues data structures according to ENA spec (bsc#1129279).\n- net: ena: limit refill Rx threshold to 256 to avoid latency issues (bsc#1129279).\n- net: ena: minor performance improvement (bsc#1129279).\n- net: ena: remove ndo_poll_controller (bsc#1129279).\n- net: ena: remove redundant parameter in ena_com_admin_init() (bsc#1129279).\n- net: ena: update driver version from 2.0.1 to 2.0.2 (bsc#1129279).\n- net: ena: update driver version from 2.0.2 to 2.0.3 (bsc#1129279).\n- net: ena: update driver version to 2.0.1 (bsc#1129279).\n- net: ena: use CSUM_CHECKED device indication to report skb's checksum status (bsc#1129279).\n- PCI: hv: Add vPCI version protocol negotiation (bnc#1043485, bsc#1122822).\n- PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC (bnc#1034113, bsc#1122822).\n- PCI: hv: Disable/enable IRQs rather than BH in hv_compose_msi_msg() (bnc#1094268, bsc#1122822).\n- PCI: hv: Do not sleep in compose_msi_msg() (bsc#1082632, bsc#1122822).\n- PCI: hv: Fix 2 hang issues in hv_compose_msi_msg() (bsc#1087659, bsc#1087906, bsc#1122822).\n- PCI: hv: Fix a comment typo in _hv_pcifront_read_config() (bsc#1087659, bsc#1122822).\n- PCI: hv: Fix comment formatting and use proper integer fields (bnc#1043485, bsc#1122822).\n- PCI: hv: Only queue new work items in hv_pci_devices_present() if necessary (bsc#1087659, bsc#1122822).\n- PCI: hv: Remove the bogus test in hv_eject_device_work() (bsc#1087659, bsc#1122822).\n- PCI: hv: Serialize the present and eject work items (bsc#1087659, bsc#1122822).\n- PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when \u003e= 32 CPUs (bnc#1043485, bsc#1122822).\n- PCI: hv: Temporary own CPU-number-to-vCPU-number infra (bnc#1043485, bsc#1122822).\n- PCI: hv: Use effective affinity mask (bsc#1109772, bsc#1122822).\n- PCI: hv: Use page allocation for hbus structure (bnc#1043485, bsc#1122822).\n- PCI: hv: Use vPCI protocol version 1.2 (bnc#1043485, bsc#1122822).\n- pci-hyperv: increase HV_VP_SET_BANK_COUNT_MAX to handle 1792 vcpus (bsc#1122822).\n- powerpc/64: Disable the speculation barrier from the command line (bsc#1068032).\n- powerpc/64s: Default l1d_size to 64K in RFI fallback flush (bsc#1068032, git-fixes).\n- powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (bsc#1068032, bsc#1080157, git-fixes).\n- powerpc/speculation: Support 'mitigations=' cmdline option (bsc#1112178).\n- powerpc/tm: Add commandline option to disable hardware transactional memory (bsc#1118338).\n- powerpc/tm: Add TM Unavailable Exception (bsc#1118338).\n- powerpc/tm: Flip the HTM switch default to disabled (bsc#1125580).\n- powerpc/vdso32: fix CLOCK_MONOTONIC on PPC64 (bsc#1131587).\n- powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 (bsc#1131587).\n- s390: add explicit \u003clinux/stringify.h\u003e for jump label (bsc#1111331).\n- sched/core: Optimize SCHED_SMT (bsc#1111331).\n- sched/smt: Expose sched_smt_present static key (bsc#1106913).\n- sched/smt: Make sched_smt_present track topology (bsc#1106913).\n- sched/smt: Update sched_smt_present at runtime (bsc#1111331).\n- scripts/git_sort/git_sort.py: Add fixes branch from mkp/scsi.git.\n- scsi: ibmvscsi: Fix empty event pool access during host removal (bsc#1119019).\n- scsi: storvsc: Reduce default ring buffer size to 128 Kbytes ().\n- time: Introduce jiffies64_to_nsecs() (bsc#1113399).\n- Use upstream variant of two pci-hyperv patches\n- vti6: flush x-netns xfrm cache when vti interface is removed (bnc#1012382 bsc#1100152).\n- x86/apic: Provide apic_ack_irq() (bsc#1122822).\n- x86/bugs: Add AMD's variant of SSB_NO (bsc#1111331).\n- x86/bugs: Rename SSBD_NO to SSB_NO (bsc#1111331).\n- x86/cpu: Rename Merrifield2 to Moorefield (bsc#1111331).\n- x86/cpu: Sanitize FAM6_ATOM naming (bsc#1111331).\n- x86/Hyper-V: Set x2apic destination mode to physical when x2apic is available (bsc#1122822).\n- x86/irq: implement irq_data_get_effective_affinity_mask() for v4.12 (bsc#1109772, bsc#1122822).\n- x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (bsc#1111331).\n- x86/kvm/vmx: Add MDS protection when L1D Flush is not active (bsc#1111331).\n- x86/msr-index: Cleanup bit defines (bsc#1111331).\n- x86/speculation: Consolidate CPU whitelists (bsc#1111331).\n- x86/speculation/mds: Add basic bug infrastructure for MDS (bsc#1111331).\n- x86/speculation/mds: Add BUG_MSBDS_ONLY (bsc#1111331).\n- x86/speculation/mds: Add mds_clear_cpu_buffers() (bsc#1111331).\n- x86/speculation/mds: Add mds=full,nosmt cmdline option (bsc#1111331).\n- x86/speculation/mds: Add mitigation control for MDS (bsc#1111331).\n- x86/speculation/mds: Add mitigation mode VMWERV (bsc#1111331).\n- x86/speculation/mds: Add 'mitigations=' support for MDS (bsc#1111331).\n- x86/speculation/mds: Add SMT warning message (bsc#1111331).\n- x86/speculation/mds: Add sysfs reporting for MDS (bsc#1111331).\n- x86/speculation/mds: Clear CPU buffers on exit to user (bsc#1111331).\n- x86/speculation/mds: Conditionally clear CPU buffers on idle entry (bsc#1111331).\n- x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (bsc#1111331).\n- x86/speculation: Move arch_smt_update() call to after mitigation decisions (bsc#1111331).\n- x86/speculation: Remove redundant arch_smt_update() invocation (bsc#1111331).\n- x86/speculation: Rework SMT state change (bsc#1111331).\n- x86/speculation: Simplify the CPU bug detection logic (bsc#1111331).\n- x86/speculation: Support 'mitigations=' cmdline option (bsc#1112178).\n- x86: stop exporting msr-index.h to userland (bsc#1111331).\n- xfrm6: call kfree_skb when skb is toobig (bnc#1012382 bsc#1100152).\n- xfrm: fix missing dst_release() after policy blocking lbcast and multicast (bnc#1012382 bsc#1100152).\n","status":"published","published":"2019-05-17T13:47:13Z","modified":"2026-02-04T03:56:00.873018Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-3361-1","title":"linux-hwe vulnerabilities","description":"USN-3358-1 fixed vulnerabilities in the Linux kernel for Ubuntu 17.04.\nThis update provides the corresponding updates for the Linux Hardware\nEnablement (HWE) kernel from Ubuntu 17.04 for Ubuntu 16.04 LTS. Please\nnote that this update changes the Linux HWE kernel to the 4.10 based\nkernel from Ubuntu 17.04, superseding the 4.8 based HWE kernel from\nUbuntu 16.10.\n\nBen Harris discovered that the Linux kernel would strip extended privilege\nattributes of files when performing a failed unprivileged system call. A\nlocal attacker could use this to cause a denial of service. (CVE-2015-1350)\n\nRalf Spenneberg discovered that the ext4 implementation in the Linux kernel\ndid not properly validate meta block groups. An attacker with physical\naccess could use this to specially craft an ext4 image that causes a denial\nof service (system crash). (CVE-2016-10208)\n\nPeter Pi discovered that the colormap handling for frame buffer devices in\nthe Linux kernel contained an integer overflow. A local attacker could use\nthis to disclose sensitive information (kernel memory). (CVE-2016-8405)\n\nIt was discovered that an integer overflow existed in the InfiniBand RDMA\nover ethernet (RXE) transport implementation in the Linux kernel. A local\nattacker could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-8636)\n\nVlad Tsyrklevich discovered an integer overflow vulnerability in the VFIO\nPCI driver for the Linux kernel. A local attacker with access to a vfio PCI\ndevice file could use this to cause a denial of service (system crash) or\npossibly execute arbitrary code. (CVE-2016-9083, CVE-2016-9084)\n\nCAI Qian discovered that the sysctl implementation in the Linux kernel did\nnot properly perform reference counting in some situations. An unprivileged\nattacker could use this to cause a denial of service (system hang).\n(CVE-2016-9191)\n\nIt was discovered that the keyring implementation in the Linux kernel in\nsome situations did not prevent special internal keyrings from being joined\nby userspace keyrings. A privileged local attacker could use this to bypass\nmodule verification. (CVE-2016-9604)\n\nDmitry Vyukov, Andrey Konovalov, Florian Westphal, and Eric Dumazet\ndiscovered that the netfiler subsystem in the Linux kernel mishandled IPv6\npacket reassembly. A local user could use this to cause a denial of service\n(system crash) or possibly execute arbitrary code. (CVE-2016-9755)\n\nAndy Lutomirski and Willy Tarreau discovered that the KVM implementation in\nthe Linux kernel did not properly emulate instructions on the SS segment\nregister. A local attacker in a guest virtual machine could use this to\ncause a denial of service (guest OS crash) or possibly gain administrative\nprivileges in the guest OS. (CVE-2017-2583)\n\nDmitry Vyukov discovered that the KVM implementation in the Linux kernel\nimproperly emulated certain instructions. A local attacker could use this\nto obtain sensitive information (kernel memory). (CVE-2017-2584)\n\nDmitry Vyukov discovered that KVM implementation in the Linux kernel\nimproperly emulated the VMXON instruction. A local attacker in a guest OS\ncould use this to cause a denial of service (memory consumption) in the\nhost OS. (CVE-2017-2596)\n\nIt was discovered that SELinux in the Linux kernel did not properly handle\nempty writes to /proc/pid/attr. A local attacker could use this to cause a\ndenial of service (system crash). (CVE-2017-2618)\n\nDaniel Jiang discovered that a race condition existed in the ipv4 ping\nsocket implementation in the Linux kernel. A local privileged attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-2671)\n\nIt was discovered that the freelist-randomization in the SLAB memory\nallocator allowed duplicate freelist entries. A local attacker could use\nthis to cause a denial of service (system crash). (CVE-2017-5546)\n\nIt was discovered that the KLSI KL5KUSB105 serial-to-USB device driver in\nthe Linux kernel did not properly initialize memory related to logging. A\nlocal attacker could use this to expose sensitive information (kernel\nmemory). (CVE-2017-5549)\n\nIt was discovered that a fencepost error existed in the pipe_advance()\nfunction in the Linux kernel. A local attacker could use this to expose\nsensitive information (kernel memory). (CVE-2017-5550)\n\nIt was discovered that the Linux kernel did not clear the setgid bit during\na setxattr call on a tmpfs filesystem. A local attacker could use this to\ngain elevated group privileges. (CVE-2017-5551)\n\nMurray McAllister discovered that an integer overflow existed in the\nVideoCore DRM driver of the Linux kernel. A local attacker could use this\nto cause a denial of service (system crash) or possibly execute arbitrary\ncode. (CVE-2017-5576)\n\nGareth Evans discovered that the shm IPC subsystem in the Linux kernel did\nnot properly restrict mapping page zero. A local privileged attacker could\nuse this to execute arbitrary code. (CVE-2017-5669)\n\nAndrey Konovalov discovered an out-of-bounds access in the IPv6 Generic\nRouting Encapsulation (GRE) tunneling implementation in the Linux kernel.\nAn attacker could use this to possibly expose sensitive information.\n(CVE-2017-5897)\n\nAndrey Konovalov discovered that the IPv4 implementation in the Linux\nkernel did not properly handle invalid IP options in some situations. An\nattacker could use this to cause a denial of service or possibly execute\narbitrary code. (CVE-2017-5970)\n\nDi Shen discovered that a race condition existed in the perf subsystem of\nthe Linux kernel. A local attacker could use this to cause a denial of\nservice or possibly gain administrative privileges. (CVE-2017-6001)\n\nDmitry Vyukov discovered that the Linux kernel did not properly handle TCP\npackets with the URG flag. A remote attacker could use this to cause a\ndenial of service. (CVE-2017-6214)\n\nAndrey Konovalov discovered that the LLC subsytem in the Linux kernel did\nnot properly set up a destructor in certain situations. A local attacker\ncould use this to cause a denial of service (system crash). (CVE-2017-6345)\n\nIt was discovered that a race condition existed in the AF_PACKET handling\ncode in the Linux kernel. A local attacker could use this to cause a denial\nof service (system crash) or possibly execute arbitrary code.\n(CVE-2017-6346)\n\nAndrey Konovalov discovered that the IP layer in the Linux kernel made\nimproper assumptions about internal data layout when performing checksums.\nA local attacker could use this to cause a denial of service (system crash)\nor possibly execute arbitrary code. (CVE-2017-6347)\n\nDmitry Vyukov discovered race conditions in the Infrared (IrDA) subsystem\nin the Linux kernel. A local attacker could use this to cause a denial of\nservice (deadlock). (CVE-2017-6348)\n\nDmitry Vyukov discovered that the generic SCSI (sg) subsystem in the Linux\nkernel contained a stack-based buffer overflow. A local attacker with\naccess to an sg device could use this to cause a denial of service (system\ncrash) or possibly execute arbitrary code. (CVE-2017-7187)\n\nIt was discovered that a NULL pointer dereference existed in the Direct\nRendering Manager (DRM) driver for VMWare devices in the Linux kernel. A\nlocal attacker could use this to cause a denial of service (system crash).\n(CVE-2017-7261)\n\nIt was discovered that the USB Cypress HID drivers for the Linux kernel did\nnot properly validate reported information from the device. An attacker\nwith physical access could use this to expose sensitive information (kernel\nmemory). (CVE-2017-7273)\n\nEric Biggers discovered a memory leak in the keyring implementation in the\nLinux kernel. A local attacker could use this to cause a denial of service\n(memory consumption). (CVE-2017-7472)\n\nIt was discovered that an information leak existed in the set_mempolicy and\nmbind compat syscalls in the Linux kernel. A local attacker could use this\nto expose sensitive information (kernel memory). (CVE-2017-7616)\n\nSabrina Dubroca discovered that the asynchronous cryptographic hash (ahash)\nimplementation in the Linux kernel did not properly handle a full request\nqueue. A local attacker could use this to cause a denial of service\n(infinite recursion). (CVE-2017-7618)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly handle certain long\nRPC replies. A remote attacker could use this to cause a denial of service\n(system crash). (CVE-2017-7645)\n\nTommi Rantala and Brad Spengler discovered that the memory manager in the\nLinux kernel did not properly enforce the CONFIG_STRICT_DEVMEM protection\nmechanism. A local attacker with access to /dev/mem could use this to\nexpose sensitive information or possibly execute arbitrary code.\n(CVE-2017-7889)\n\nTuomas Haanpää and Ari Kauppi discovered that the NFSv2 and NFSv3 server\nimplementations in the Linux kernel did not properly check for the end of\nbuffer. A remote attacker could use this to craft requests that cause a\ndenial of service (system crash) or possibly execute arbitrary code.\n(CVE-2017-7895)\n\nIt was discovered that an integer underflow existed in the Edgeport USB\nSerial Converter device driver of the Linux kernel. An attacker with\nphysical access could use this to expose sensitive information (kernel\nmemory). (CVE-2017-8924)\n\nIt was discovered that the USB ZyXEL omni.net LCD PLUS driver in the Linux\nkernel did not properly perform reference counting. A local attacker could\nuse this to cause a denial of service (tty exhaustion). (CVE-2017-8925)\n\nJann Horn discovered that bpf in Linux kernel does not restrict the output\nof the print_bpf_insn function. A local attacker could use this to obtain\nsensitive address information. (CVE-2017-9150)\n","status":"published","published":"2017-07-21T09:59:15Z","modified":"2026-06-03T14:04:19.16359445Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}