CVE-2016-7042

NameCVE-2016-7042
DescriptionThe proc_keys_show function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection (gcc) stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service (stack memory corruption and panic) by reading the /proc/keys file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-670-1, DSA-3696-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)jessie, jessie (lts)3.16.84-1fixed
stretch (security)4.9.320-2fixed
stretch (lts), stretch4.9.320-3fixed
buster4.19.249-2fixed
buster (security)4.19.304-1fixed
bullseye5.10.209-2fixed
bullseye (security)5.10.216-1fixed
bookworm6.1.76-1fixed
bookworm (security)6.1.90-1fixed
trixie6.7.12-1fixed
sid6.8.9-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcewheezy3.2.82-1DLA-670-1
linuxsourcejessie3.16.36-1+deb8u2DSA-3696-1
linuxsource(unstable)4.7.8-1

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=1373966
https://bugzilla.redhat.com/show_bug.cgi?id=1373499
https://git.kernel.org/linus/03dab869b7b239c4e013ec82aea22e181e441cfc

Search for package or bug name: Reporting problems