CVE-2016-3699

The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.

CVSS v3 7.4 HIGH
CVSS v2.0 6.9 MEDIUM

7.4^/10

CVSS v3 : HIGH

Vector : AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.4 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2016-2574.html
http://rhn.redhat.com/errata/RHSA-2016-2584.html
http://www.openwall.com/lists/oss-security/2016/09/22/4	Third Party Advisory
http://www.securityfocus.com/bid/93114	Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=1329653	Issue Tracking Patch Third Party Advisory VDB Entry
https://github.com/mjg59/linux/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:redhat:enterprise_mrg:2.0:::::::*
	cpe:2.3:o:redhat:linux:7.2:::::::*

History

No history.

Information

Published : 2016-10-07 14:59

Updated : 2024-02-28 15:21

NVD link : CVE-2016-3699

Mitre link : CVE-2016-3699

CVE.ORG link : CVE-2016-3699

JSON object : View

Products Affected

linux

linux_kernel

redhat

enterprise_mrg
linux

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2016-3699", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.4}]}, "published": "2016-10-07T14:59:03.897", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2016-2574.html", "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-2584.html", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/22/4", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/93114", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1329653", "tags": ["Issue Tracking", "Patch", "Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "https://github.com/mjg59/linux/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76", "tags": ["Exploit"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd."}, {"lang": "es", "value": "El kernel de Linux, tal como se utiliza en Red Hat Enterprise Linux 7.2 y Red Hat Enterprise MRG 2 y cuando se arranca con UEFI Secure Boot habilitado, permite a usuarios locales eludir las restricciones destinadas a Secure Boot y ejecutar c\u00f3digo no confiable a\u00f1adiendo tablas ACPI para el initrd."}], "lastModified": "2023-02-13T04:50:08.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C60FA8B1-1802-4522-A088-22171DCF7A93"}, {"criteria": "cpe:2.3:o:redhat:linux:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E562907F-D915-4030-847A-3C6834A80D4E"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}