The assocarrayinsertintoterminalnode function in lib/assocarray.c in the Linux kernel before 4.5.3 does not check whether a slot is a leaf, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and out-of-bounds read) via an application that uses associative-array data structures, as demonstrated by the keyutils test suite.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7914.json"
[
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2",
"digest": {
"line_hashes": [
"144461370979807373840650790200432066939",
"192507858534102162893427459350023256386",
"278708074053032753109170180628122835466",
"235572688822938656430212029219089875832"
],
"threshold": 0.9
},
"id": "CVE-2016-7914-0aab1575",
"deprecated": false,
"target": {
"file": "lib/assoc_array.c"
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2",
"digest": {
"function_hash": "174515794068710879478734986136681396090",
"length": 7660.0
},
"id": "CVE-2016-7914-144918bf",
"deprecated": false,
"target": {
"file": "lib/assoc_array.c",
"function": "assoc_array_insert_into_terminal_node"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7914.json"
[
{
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2",
"digest": {
"function_hash": "174515794068710879478734986136681396090",
"length": 7660.0
},
"id": "CVE-2016-7914-83abffbb",
"deprecated": false,
"target": {
"file": "lib/assoc_array.c",
"function": "assoc_array_insert_into_terminal_node"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2",
"digest": {
"line_hashes": [
"144461370979807373840650790200432066939",
"192507858534102162893427459350023256386",
"278708074053032753109170180628122835466",
"235572688822938656430212029219089875832"
],
"threshold": 0.9
},
"id": "CVE-2016-7914-a0fc6b35",
"deprecated": false,
"target": {
"file": "lib/assoc_array.c"
}
}
]