CVE-2016-2847

Published on: 04/27/2016 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:15 PM UTC

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Certain versions of Linux Kernel from Linux contain the following vulnerability:

fs/pipe.c in the Linux kernel before 4.5 does not limit the amount of unread data in pipes, which allows local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes.

  • CVE-2016-2847 has been assigned by [email protected] to track the vulnerability - currently rated as MEDIUM severity.

CVSS3 Score: 6.2 - MEDIUM

Attack
Vector
Attack
Complexity
Privileges
Required
User
Interaction
LOCAL LOW NONE NONE
Scope Confidentiality
Impact
Integrity
Impact
Availability
Impact
UNCHANGED NONE NONE HIGH

CVSS2 Score: 4.9 - MEDIUM

Access
Vector
Access
Complexity
Authentication
LOCAL LOW NONE
Confidentiality
Impact
Integrity
Impact
Availability
Impact
NONE NONE COMPLETE

CVE References

Description Tags Link
[security-announce] openSUSE-SU-2016:1382-1: important: Security update lists.opensuse.org
text/html
URL Logo SUSE openSUSE-SU-2016:1382
USN-2947-3: Linux kernel (Raspberry Pi 2) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2947-3
USN-2947-1: Linux kernel vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2947-1
USN-2967-2: Linux kernel (OMAP4) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2967-2
Debian -- Security Information -- DSA-3503-1 linux www.debian.org
Depreciated Link
text/html
URL Logo DEBIAN DSA-3503
[security-announce] SUSE-SU-2016:1937-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1937
[security-announce] SUSE-SU-2016:1707-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1707
Oracle Linux Bulletin - July 2016 web.archive.org
text/html
Inactive LinkNot Archived
URL Logo CONFIRM www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
USN-2948-2: Linux kernel (Utopic HWE) regression | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2948-2
USN-2946-1: Linux kernel vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2946-1
oss-security - CVE request -- linux kernel: pipe: limit the per-user amount of pages allocated in pipes Patch
www.openwall.com
text/html
URL Logo MLIST [oss-security] 20160301 CVE request -- linux kernel: pipe: limit the per-user amount of pages allocated in pipes
USN-2946-2: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2946-2
Red Hat Customer Portal web.archive.org
text/html
Inactive LinkNot Archived
URL Logo REDHAT RHSA-2016:2574
[security-announce] SUSE-SU-2016:2074-1: important: Security update for lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:2074
[security-announce] SUSE-SU-2016:1672-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1672
USN-2948-1: Linux kernel (Utopic HWE) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2948-1
Oracle VM Server for x86 Bulletin - October 2016 www.oracle.com
text/html
URL Logo CONFIRM www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html
pipe: limit the per-user amount of pages allocated in pipes · torvalds/[email protected] · GitHub github.com
text/html
URL Logo CONFIRM github.com/torvalds/linux/commit/759c01142a5d0f364a462346168a56de28a80f52
USN-2947-2: Linux kernel (Wily HWE) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2947-2
Red Hat Customer Portal web.archive.org
text/html
Inactive LinkNot Archived
URL Logo REDHAT RHSA-2017:0217
USN-2967-1: Linux kernel vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2967-1
Linux Kernel 'fs/pipe.c' Local Denial of Service Vulnerability cve.report (archive)
text/html
URL Logo BID 83870
[security-announce] SUSE-SU-2016:1690-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1690
[security-announce] SUSE-SU-2016:1696-1: important: Security update for Third Party Advisory
lists.opensuse.org
text/html
URL Logo SUSE SUSE-SU-2016:1696
Bug 1313428 – CVE-2016-2847 kernel: pipe: limit the per-user amount of pages allocated in pipes Issue Tracking
bugzilla.redhat.com
text/html
URL Logo CONFIRM bugzilla.redhat.com/show_bug.cgi?id=1313428
kernel/git/torvalds/linux.git - Linux kernel source tree Patch
Vendor Advisory
git.kernel.org
text/html
URL Logo CONFIRM git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=759c01142a5d0f364a462346168a56de28a80f52
Red Hat Customer Portal web.archive.org
text/html
Inactive LinkNot Archived
URL Logo REDHAT RHSA-2016:2584
USN-2949-1: Linux kernel (Vivid HWE) vulnerabilities | Ubuntu www.ubuntu.com
text/html
URL Logo UBUNTU USN-2949-1

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
Operating
System
LinuxLinux KernelAllAllAllAll
Operating
System
NovellSuse Linux Enterprise Debuginfo11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Debuginfo11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Desktop12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Desktop12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Desktop12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Desktop12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Live Patching12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Live Patching12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Module For Public Cloud12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Module For Public Cloud12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Real Time Extension11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Real Time Extension12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Real Time Extension11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Real Time Extension12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Server11.0extraAllAll
Operating
System
NovellSuse Linux Enterprise Server11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Server12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Server12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Server11.0extraAllAll
Operating
System
NovellSuse Linux Enterprise Server11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Server12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Server12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit11.0sp4AllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Software Development Kit12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Workstation Extension12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Workstation Extension12.0sp1AllAll
Operating
System
NovellSuse Linux Enterprise Workstation Extension12.0AllAllAll
Operating
System
NovellSuse Linux Enterprise Workstation Extension12.0sp1AllAll
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_debuginfo:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_debuginfo:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_desktop:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_live_patching:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_live_patching:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_module_for_public_cloud:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_module_for_public_cloud:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:extra:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:extra:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_server:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:11.0:sp4:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_software_development_kit:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:novell:suse_linux_enterprise_workstation_extension:12.0:sp1:*:*:*:*:*:*: