UBUNTU-CVE-2016-7917 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2016-7917

MEDIUM5.0

The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain s

Published Nov 16, 2016

Modified 8 months ago

Fix available

Details

The nfnetlink_rcv_batch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by leveraging the CAP_NET_ADMIN capability.

Affected Packages(144 packages)

linux

Ubuntu 22.04 LTS

Fixed in:

5.13.0-19.19

linux

Ubuntu 20.04 LTS

Affected versions:

5.3.0-18.195.3.0-24.26

Fixed in:

5.4.0-9.12

linux

Ubuntu 24.04 LTS

Fixed in:

6.5.0-9.9

linux

Ubuntu 24.10

Fixed in:

6.8.0-31.31

linux

Ubuntu 16.04 LTS

Affected versions:

4.2.0-16.194.2.0-17.214.2.0-19.234.3.0-1.104.3.0-2.114.3.0-5.164.3.0-6.174.3.0-7.184.4.0-10.254.4.0-11.26+42 more

Fixed in:

4.4.0-79.100

linux

Ubuntu 14.04 LTS

Fixed in:

3.11.0-12.19

linux

Ubuntu 18.04 LTS

Fixed in:

4.13.0-16.19

linux-aws

Ubuntu 22.04 LTS

Fixed in:

5.13.0-1005.6

linux-aws

Ubuntu 14.04 LTS

Fixed in:

4.4.0-1002.2

linux-aws

Ubuntu 16.04 LTS

Affected versions:

4.4.0-1001.104.4.0-1003.124.4.0-1004.134.4.0-1007.164.4.0-1009.184.4.0-1011.204.4.0-1012.214.4.0-1013.224.4.0-1016.254.4.0-1017.26

Fixed in:

4.4.0-1018.27

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c58d6c93680f28ac58984af61d0a7ebf4319c241

http://source.android.com/security/bulletin/2016-11-01.html

https://github.com/torvalds/linux/commit/c58d6c93680f28ac58984af61d0a7ebf4319c241

https://ubuntu.com/security/CVE-2016-7917

https://ubuntu.com/security/notices/USN-3312-1

https://ubuntu.com/security/notices/USN-3312-2

https://www.cve.org/CVERecord?id=CVE-2016-7917

CVSS Analysis

CVSS v3.0

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Related

CVE-2016-7917 USN-3312-1 USN-3312-2

Ecosystems(28)

Ubuntu 22.04 LTS Ubuntu 20.04 LTS Ubuntu 24.04 LTS Ubuntu 24.10 Ubuntu 16.04 LTS

Timeline

PublishedNov 16, 2016

ModifiedJun 24, 2025