The nfnetlinkrcvbatch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service (infinite loop or out-of-bounds read) by leveraging the CAPNETADMIN capability.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-7917.json"
[
{
"id": "CVE-2016-7917-398082ea",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@c58d6c93680f28ac58984af61d0a7ebf4319c241",
"target": {
"file": "net/netfilter/nfnetlink.c",
"function": "nfnetlink_rcv_batch"
},
"digest": {
"function_hash": "81763624593874942058011771989735657609",
"length": 2854.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2016-7917-a5bf28a3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@c58d6c93680f28ac58984af61d0a7ebf4319c241",
"target": {
"file": "net/netfilter/nfnetlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"48671092458710921088144799160679908646",
"316994430735388652873597304391128882897",
"162879992858008843542075579481759018252",
"150212436621633072228498961093013983314",
"24895437545675671251176816030726341804",
"139935970012982153628557534021050549549",
"50423470092489836917840319650574467415"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-7917.json"
[
{
"id": "CVE-2016-7917-4dec46e9",
"source": "https://github.com/torvalds/linux/commit/c58d6c93680f28ac58984af61d0a7ebf4319c241",
"target": {
"file": "net/netfilter/nfnetlink.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"48671092458710921088144799160679908646",
"316994430735388652873597304391128882897",
"162879992858008843542075579481759018252",
"150212436621633072228498961093013983314",
"24895437545675671251176816030726341804",
"139935970012982153628557534021050549549",
"50423470092489836917840319650574467415"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2016-7917-60908895",
"source": "https://github.com/torvalds/linux/commit/c58d6c93680f28ac58984af61d0a7ebf4319c241",
"target": {
"file": "net/netfilter/nfnetlink.c",
"function": "nfnetlink_rcv_batch"
},
"digest": {
"function_hash": "81763624593874942058011771989735657609",
"length": 2854.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]