The blkrqmapuseriov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9576.json"
[
{
"id": "CVE-2016-9576-55a062a3",
"signature_type": "Function",
"digest": {
"function_hash": "119729276275438905630497490501866502502",
"length": 725.0
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a0ac402cfcdc904f9772e1762b3fda112dcc56a0",
"target": {
"function": "blk_rq_map_user_iov",
"file": "block/blk-map.c"
},
"deprecated": false
},
{
"id": "CVE-2016-9576-f113abff",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"237462217944665173082090318169784910107",
"96299961927462933309089519110147078405",
"82877477624470971765240459139546259765",
"163319067523520501237013115818934180716",
"47507503212521610025053530463827905926",
"246575103363653327778422240334030329138",
"111986337628683045613816868052235912360"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a0ac402cfcdc904f9772e1762b3fda112dcc56a0",
"target": {
"file": "block/blk-map.c"
},
"deprecated": false
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-9576.json"
[
{
"id": "CVE-2016-9576-628a6899",
"signature_type": "Function",
"digest": {
"function_hash": "119729276275438905630497490501866502502",
"length": 725.0
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/a0ac402cfcdc904f9772e1762b3fda112dcc56a0",
"target": {
"function": "blk_rq_map_user_iov",
"file": "block/blk-map.c"
},
"deprecated": false
},
{
"id": "CVE-2016-9576-a4d88386",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"237462217944665173082090318169784910107",
"96299961927462933309089519110147078405",
"82877477624470971765240459139546259765",
"163319067523520501237013115818934180716",
"47507503212521610025053530463827905926",
"246575103363653327778422240334030329138",
"111986337628683045613816868052235912360"
]
},
"signature_version": "v1",
"source": "https://github.com/torvalds/linux/commit/a0ac402cfcdc904f9772e1762b3fda112dcc56a0",
"target": {
"file": "block/blk-map.c"
},
"deprecated": false
}
]