peter bassill · operator
$ cve CVE-2016-4997 JSON

CVE-2016-4997 EXPLOIT

7.8
HIGH · CVSS 3.1 · EPSS 7% (pctl 94)

Patch early

A public exploit exists.

Description

The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.

Scoring

CVSS7.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS6.98% — more likely to be exploited than 94% of all CVEs
WeaknessCWE-264
On CISA KEVno
Public exploityes
Published2016-07-03
Last modified2026-06-17

Affected (11)

VendorProduct
canonicalubuntu linux
debiandebian linux
linuxlinux kernel
novellsuse linux enterprise desktop
novellsuse linux enterprise live patching
novellsuse linux enterprise module for public cloud
novellsuse linux enterprise real time extension
novellsuse linux enterprise server
novellsuse linux enterprise software development kit
novellsuse linux enterprise workstation extension
oraclelinux

Public exploits

SourceTitleDate
exploit-dbLinux Kernel 4.6.2 (Ubuntu 16.04.1) - 'IP6T_SO_SET_REPLACE' Local Privilege Escalation2016-10-10
exploit-dbLinux Kernel 4.6.3 (x86) - 'Netfilter' Local Privilege Escalation (Metasploit)2016-09-27

References

→ the Explorer  ·  watch your stack  ·  NVD