CVE-2016-9754

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The ring_buffer_resize function in kernel/trace/ring_buffer.c in the profiling subsystem in the Linux kernel before 4.6.1 mishandles certain integer calculations, which allows local users to gain privileges by writing to the /sys/kernel/debug/tracing/buffer_size_kb file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59643d1535eb220668692a5359de22545af579f6Exploit, Patch, Vendor Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.1Release Notes
http://www.securityfocus.com/bid/95278Third Party Advisory, VDB Entry
https://github.com/torvalds/linux/commit/59643d1535eb220668692a5359de22545af579f6Patch, Vendor Advisory
https://source.android.com/security/bulletin/2017-01-01.htmlThird Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59643d1535eb220668692a5359de22545af579f6Exploit, Patch, Vendor Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.1Release Notes
http://www.securityfocus.com/bid/95278Third Party Advisory, VDB Entry
https://github.com/torvalds/linux/commit/59643d1535eb220668692a5359de22545af579f6Patch, Vendor Advisory
https://source.android.com/security/bulletin/2017-01-01.htmlThird Party Advisory

Timeline

Published: Jan 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-97557.8The netfilter subsystem in the Linux kernel before 4.9 mishandles IPv6 reassembly, which allows local users to cause a denial of service (in CVE-2016-97565.5arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows CVE-2016-97575.4In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags ca CVE-2016-97725.3OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache part CVE-2016-97735.5Heap-based buffer overflow in the IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows remote attackers to caus CVE-2016-97747.8The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on CVE-2016-97757.8The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before CVE-2016-97765.5QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It coul CVE-2016-97777.8KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to g CVE-2016-97785.9An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for CVE-2016-97937.8The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, whi CVE-2016-97947.8Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows lo