CVE-2016-10154

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG_VMAP_STACK option, which allows local users to cause a denial of service (system crash or memory corruption) or possibly have unspecified other impact by leveraging use of more than one virtual page for a scatterlist.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06deeec77a5a689cc94b21a8a91a76e42176685dIssue Tracking, Patch, Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.1Release Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2017/01/21/3Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95714Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1416104Issue Tracking, Patch
https://github.com/torvalds/linux/commit/06deeec77a5a689cc94b21a8a91a76e42176685dIssue Tracking, Patch, Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=06deeec77a5a689cc94b21a8a91a76e42176685dIssue Tracking, Patch, Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.1Release Notes, Vendor Advisory
http://www.openwall.com/lists/oss-security/2017/01/21/3Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/95714Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1416104Issue Tracking, Patch
https://github.com/torvalds/linux/commit/06deeec77a5a689cc94b21a8a91a76e42176685dIssue Tracking, Patch, Third Party Advisory

Timeline

Published: Feb 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-101556.0Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (CVE-2016-101567.8A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowi CVE-2016-101579.8Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is ag CVE-2016-101587.5The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote atta CVE-2016-101597.5Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers CVE-2016-10168.8Use-after-free vulnerability in the Transform object implementation in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.CVE-2016-101609.8Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers CVE-2016-101617.5The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remo CVE-2016-101627.5The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a de CVE-2016-101636.5Memory leak in the vrend_renderer_context_create_internal function in vrend_decode.c in virglrenderer before 0.6.0 allows local guest OS use CVE-2016-101649.8Multiple integer overflows in libXpm before 3.5.12, when a program requests parsing XPM extensions on a 64-bit platform, allow remote attack CVE-2016-101657.1The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial