Back to bug 1301893
| Who | When | What | Removed | Added |
|---|---|---|---|---|
| Andrej Nemec | 2016-01-26 09:58:30 UTC | Blocks | 1301883 | |
| Slawomir Czarko | 2016-01-27 09:28:10 UTC | CC | slawomir | |
| Vladis Dronov | 2016-05-03 13:56:05 UTC | Whiteboard | impact=moderate,public=20160125,reported=20160125,source=oss-security,cvss2=3.5/AV:L/AC:H/Au:S/C:P/I:P/A:P,cwe=CWE-266,rhel-6/kernel=new,rhel-7/kernel=new | impact=moderate,public=20160125,reported=20160125,source=oss-security,cvss2=3.7/AV:L/AC:H/Au:N/C:P/I:P/A:P,cwe=CWE-266,rhel-6/kernel=new,rhel-7/kernel=new |
| Vladis Dronov | 2016-05-03 14:28:03 UTC | CC | vdronov | |
| Whiteboard | impact=moderate,public=20160125,reported=20160125,source=oss-security,cvss2=3.7/AV:L/AC:H/Au:N/C:P/I:P/A:P,cwe=CWE-266,rhel-6/kernel=new,rhel-7/kernel=new | impact=moderate,public=20160125,reported=20160125,source=oss-security,cvss2=3.7/AV:L/AC:H/Au:N/C:P/I:P/A:P,cwe=CWE-266,rhel-5/kernel=wontfix,rhel-6/kernel=affected,rhel-7/kernel=affected,rhel-7/kernel-rt=affected,mrg-2/realtime-kernel=affected,rhelsa-7/arm-kernel=notaffected,fedora-all/kernel=affected | ||
| Vladis Dronov | 2016-05-03 14:44:50 UTC | Depends On | 1332601 | |
| Vladis Dronov | 2016-05-03 14:45:02 UTC | Depends On | 1332602 | |
| Vladis Dronov | 2016-05-03 14:45:13 UTC | Depends On | 1332603 | |
| Vladis Dronov | 2016-05-03 14:45:18 UTC | Depends On | 1332604 | |
| Vladis Dronov | 2016-06-14 20:28:29 UTC | Doc Text | A flaw was discovered in a way the Linux deals with paging structures. When Linux invalidates a paging structure that is not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A successful exploit would result in a user thread running with a stale cached virtual->physical translation. If the translation in question were writable and the physical page got reused for something critical (e.g. a page table), then this would permit privilege escalation without any syscall. |
|
| Eric Christensen | 2016-06-14 23:31:14 UTC | Doc Text | A flaw was discovered in a way the Linux deals with paging structures. When Linux invalidates a paging structure that is not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A successful exploit would result in a user thread running with a stale cached virtual->physical translation. If the translation in question were writable and the physical page got reused for something critical (e.g. a page table), then this would permit privilege escalation without any syscall. | A flaw was discovered in a way that Linux deals with paging structures. When Linux invalidates a paging structure that is not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A successful exploit would result in a user thread running with a stale cached virtual->physical translation. If the translation in question were writable and the physical page got reused for something critical (e.g. a page table), then this would permit privilege escalation without any syscall. |
| John Skeoch | 2016-10-04 04:22:12 UTC | CC | pholasek | |
| Martin Prpič | 2016-11-01 15:18:19 UTC | Doc Text | A flaw was discovered in a way that Linux deals with paging structures. When Linux invalidates a paging structure that is not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A successful exploit would result in a user thread running with a stale cached virtual->physical translation. If the translation in question were writable and the physical page got reused for something critical (e.g. a page table), then this would permit privilege escalation without any syscall. | A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (e.g. a page table). |
| Tomas Hoger | 2017-03-07 10:18:06 UTC | Summary | CVE-2016-2069 kernel: race condition in the TLB flush logic | CVE-2016-2069 kernel: race condition in the TLB flush logic |
| Martin Prpič | 2017-03-20 09:45:30 UTC | Doc Text | A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (e.g. a page table). | A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (for example, a page table). |
| Prasad Pandit | 2017-03-21 05:43:42 UTC | Whiteboard | impact=moderate,public=20160125,reported=20160125,source=oss-security,cvss2=3.7/AV:L/AC:H/Au:N/C:P/I:P/A:P,cwe=CWE-266,rhel-5/kernel=wontfix,rhel-6/kernel=affected,rhel-7/kernel=affected,rhel-7/kernel-rt=affected,mrg-2/realtime-kernel=affected,rhelsa-7/arm-kernel=notaffected,fedora-all/kernel=affected | impact=moderate,public=20160125,reported=20160125,source=oss-security,cvss2=3.7/AV:L/AC:H/Au:N/C:P/I:P/A:P,cvss3=4.9/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L,cwe=CWE-266,rhel-5/kernel=wontfix,rhel-6/kernel=affected,rhel-7/kernel=affected,rhel-7/kernel-rt=affected,mrg-2/realtime-kernel=affected,rhelsa-7/arm-kernel=notaffected,fedora-all/kernel=affected |
| PnT Account Manager | 2018-02-07 23:10:49 UTC | CC | agordeev | |
| PnT Account Manager | 2018-07-19 06:14:11 UTC | CC | mguzik | |
| PnT Account Manager | 2018-08-28 22:02:10 UTC | CC | lwang | |
| Product Security DevOps Team | 2019-06-08 02:47:48 UTC | Status | NEW | CLOSED |
| Resolution | --- | ERRATA | ||
| Last Closed | 2019-06-08 02:47:48 UTC | |||
| Product Security DevOps Team | 2019-09-29 13:43:28 UTC | Whiteboard | impact=moderate,public=20160125,reported=20160125,source=oss-security,cvss2=3.7/AV:L/AC:H/Au:N/C:P/I:P/A:P,cvss3=4.9/CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L,cwe=CWE-266,rhel-5/kernel=wontfix,rhel-6/kernel=affected,rhel-7/kernel=affected,rhel-7/kernel-rt=affected,mrg-2/realtime-kernel=affected,rhelsa-7/arm-kernel=notaffected,fedora-all/kernel=affected |
Back to bug 1301893