CVE-2016-3699

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.

Metrics

CVSS 3.0 7.4/10CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-2574.html
http://rhn.redhat.com/errata/RHSA-2016-2584.html
http://www.openwall.com/lists/oss-security/2016/09/22/4Third Party Advisory
http://www.securityfocus.com/bid/93114Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=1329653Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://github.com/mjg59/linux/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76Exploit
http://rhn.redhat.com/errata/RHSA-2016-2574.html
http://rhn.redhat.com/errata/RHSA-2016-2584.html
http://www.openwall.com/lists/oss-security/2016/09/22/4Third Party Advisory
http://www.securityfocus.com/bid/93114Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=1329653Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://github.com/mjg59/linux/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76Exploit

Timeline

Published: Oct 7, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-37025.3Padding oracle flaw in CloudForms Management Engine (aka CFME) 5 allows remote attackers to obtain sensitive cleartext information.CVE-2016-37035.3Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/prox CVE-2016-37047.5Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.CVE-2016-37057.5The (1) xmlParserEntityCheck and (2) xmlParseAttValueComplex functions in parser.c in libxml2 2.9.3 do not properly keep track of the recurs CVE-2016-37067.5Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remo CVE-2016-37078.1The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt packag CVE-2016-37087.1Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from po CVE-2016-37096.1Possible cross-site scripting vulnerability in libxml after commit 960f0e2.CVE-2016-37108.8The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to e CVE-2016-37113.3HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading th CVE-2016-37125.5Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process cra CVE-2016-37137.1The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read