CVE-2016-0728

HIGH

7.8

CVSS Score

Published: February 8, 2016 at 02:00 AM UTC

Updated: June 17, 2026 at 12:38 AM UTC

5 products affected across 5 vendorsLinux KernelDebian LinuxAndroid

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 3%

Description

The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux · Canonicalrubygems

95%

12.04 14.04 15.04 15.10

Debian Linux · Debiandrupal

95%

8.0

Android · Google

95%

4.0 4.0.1 4.0.2 4.0.3 4.0.4 4.1 4.1.2 4.2 4.2.1 4.2.2 4.3 4.3.1 4.4 4.4.1 4.4.2 4.4.3 5.0 5.0.1 5.0.2 5.1 5.1.0 5.1.1 6.0 6.0.1

Server Migration Pack · HP

95%

v ≤ 7.5

Linux Kernel · Linux

95%

3.11 ≤ v < 3.12.533.13 ≤ v < 3.14.593.15 ≤ v < 3.16.353.17 ≤ v < 3.18.263.19 ≤ v < 4.1.163.8 ≤ v < 3.10.954.2 ≤ v < 4.3.44.4 ≤ v < 4.4.1

Affected range stops below 3.10.95, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.12.53, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.14.59, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.16.35, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.18.26, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.1.16, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.3.4, so it looks safe — our inference, not a vendor statement

Affected range stops below 4.4.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (42)

x_refsource_CONFIRMVendor Advisory

Source: [email protected]

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2

Vendor Advisoryx_refsource_FEDORAMailing ListThird Party Advisory

Source: [email protected]

http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html

Vendor Advisoryx_refsource_FEDORAMailing ListThird Party Advisory

Source: [email protected]

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176194.html