CVE-2016-2568

HighCVSS 7.8/10Last modified Oct 8, 2026

Description

pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/02/26/3Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2016-2568Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816062Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1300746Issue Tracking, Third Party Advisory
https://ubuntu.com/security/CVE-2016-2568Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/02/26/3Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2016-2568Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816062Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1300746Issue Tracking, Third Party Advisory
https://ubuntu.com/security/CVE-2016-2568Third Party Advisory

Timeline

Published: Feb 13, 2017
Last modified: Oct 8, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-25697.5Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial CVE-2016-25707.5The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which a CVE-2016-25717.5http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which al CVE-2016-25727.5http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause CVE-2016-27745.9ISC DHCP 4.1.x before 4.1-ESV-R13 and 4.2.x and 4.3.x before 4.3.4 does not restrict the number of concurrent TCP sessions, which allows rem CVE-2016-27755.9ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows CVE-2016-27767.5buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses,CVE-2016-27797.8runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the te CVE-2016-27807.8Untrusted search path vulnerability in Huawei UTPS before UTPS-V200R003B015D15SP00C983 allows local users to execute arbitrary code and cond CVE-2016-27814.6chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, whi CVE-2016-27824.6The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denia CVE-2016-27839.8Avaya Fabric Connect Virtual Services Platform (VSP) Operating System Software (VOSS) before 4.2.3.0 and 5.x before 5.0.1.0 does not properl