The arcmsriopmessagexfer function in drivers/scsi/arcmsr/arcmsrhba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSRMESSAGEWRITE_WQBUFFER control code.
[
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"94172950260741254411967920225066166802",
"263479144739971767762579176112480271708",
"160017053057339123816018436555683567303",
"200423067396123827642451889336698896377",
"34570037340774335685210840798190671071",
"288624640913870165377714657551255781253",
"190313184252067513834908453250408193980",
"54121601911617363736471870691502011412"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/scsi/arcmsr/arcmsr_hba.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7bc2b55a5c030685b399bb65b6baa9ccc3d1f167",
"id": "CVE-2016-7425-50641f77",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 6888.0,
"function_hash": "70771982101555831229229559843568688949"
},
"signature_version": "v1",
"target": {
"function": "arcmsr_iop_message_xfer",
"file": "drivers/scsi/arcmsr/arcmsr_hba.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@7bc2b55a5c030685b399bb65b6baa9ccc3d1f167",
"id": "CVE-2016-7425-f00e7e08",
"deprecated": false
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-7425.json"
[
{
"signature_type": "Function",
"digest": {
"length": 6888.0,
"function_hash": "70771982101555831229229559843568688949"
},
"signature_version": "v1",
"target": {
"function": "arcmsr_iop_message_xfer",
"file": "drivers/scsi/arcmsr/arcmsr_hba.c"
},
"source": "https://github.com/torvalds/linux/commit/7bc2b55a5c030685b399bb65b6baa9ccc3d1f167",
"id": "CVE-2016-7425-2041dd00",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"94172950260741254411967920225066166802",
"263479144739971767762579176112480271708",
"160017053057339123816018436555683567303",
"200423067396123827642451889336698896377",
"34570037340774335685210840798190671071",
"288624640913870165377714657551255781253",
"190313184252067513834908453250408193980",
"54121601911617363736471870691502011412"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "drivers/scsi/arcmsr/arcmsr_hba.c"
},
"source": "https://github.com/torvalds/linux/commit/7bc2b55a5c030685b399bb65b6baa9ccc3d1f167",
"id": "CVE-2016-7425-ed7a3183",
"deprecated": false
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-7425.json"