The sg implementation in the Linux kernel through 4.9 does not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10088.json"
[
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@128394eff343fc6d2f32172f03e24829539c5835",
"digest": {
"line_hashes": [
"9224127032538468973494639717499462262",
"217621854828745628191565846403001370369",
"220809426400496538001977217517049904045"
],
"threshold": 0.9
},
"id": "CVE-2016-10088-06188489",
"deprecated": false,
"target": {
"file": "drivers/scsi/sg.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@128394eff343fc6d2f32172f03e24829539c5835",
"digest": {
"function_hash": "189416932144456222522723947680999733395",
"length": 2963.0
},
"id": "CVE-2016-10088-52ddafc2",
"deprecated": false,
"target": {
"file": "drivers/scsi/sg.c",
"function": "sg_write"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@128394eff343fc6d2f32172f03e24829539c5835",
"digest": {
"line_hashes": [
"236289948559494027327301697411948765111",
"268085959801743527405200515099577655526",
"30305017753665724371165226187256772406"
],
"threshold": 0.9
},
"id": "CVE-2016-10088-7bbb777c",
"deprecated": false,
"target": {
"file": "block/bsg.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@128394eff343fc6d2f32172f03e24829539c5835",
"digest": {
"function_hash": "160780963008843716937597657788387204050",
"length": 467.0
},
"id": "CVE-2016-10088-da2fd3f0",
"deprecated": false,
"target": {
"file": "block/bsg.c",
"function": "bsg_write"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10088.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/128394eff343fc6d2f32172f03e24829539c5835",
"digest": {
"function_hash": "189416932144456222522723947680999733395",
"length": 2963.0
},
"id": "CVE-2016-10088-11cad996",
"deprecated": false,
"target": {
"file": "drivers/scsi/sg.c",
"function": "sg_write"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/128394eff343fc6d2f32172f03e24829539c5835",
"digest": {
"line_hashes": [
"236289948559494027327301697411948765111",
"268085959801743527405200515099577655526",
"30305017753665724371165226187256772406"
],
"threshold": 0.9
},
"id": "CVE-2016-10088-8048b0ae",
"deprecated": false,
"target": {
"file": "block/bsg.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/128394eff343fc6d2f32172f03e24829539c5835",
"digest": {
"line_hashes": [
"9224127032538468973494639717499462262",
"217621854828745628191565846403001370369",
"220809426400496538001977217517049904045"
],
"threshold": 0.9
},
"id": "CVE-2016-10088-cc3cedb7",
"deprecated": false,
"target": {
"file": "drivers/scsi/sg.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/128394eff343fc6d2f32172f03e24829539c5835",
"digest": {
"function_hash": "160780963008843716937597657788387204050",
"length": 467.0
},
"id": "CVE-2016-10088-d7ed5778",
"deprecated": false,
"target": {
"file": "block/bsg.c",
"function": "bsg_write"
}
}
]