The ringbufferresize function in kernel/trace/ringbuffer.c in the profiling subsystem in the Linux kernel before 4.6.1 mishandles certain integer calculations, which allows local users to gain privileges by writing to the /sys/kernel/debug/tracing/buffersize_kb file.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9754.json"
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@59643d1535eb220668692a5359de22545af579f6",
"digest": {
"length": 2589.0,
"function_hash": "290750522883156964132839019910174695988"
},
"id": "CVE-2016-9754-00753ba6",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/trace/ring_buffer.c",
"function": "ring_buffer_resize"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@59643d1535eb220668692a5359de22545af579f6",
"digest": {
"line_hashes": [
"38999631357087133190610000041246712044",
"247142704931748006276282255321837882192",
"51949467991174106505023942127430155596",
"246426195170731150658828107860383155347",
"269930116332395430356628380906952823394",
"238930258180314091852747116444582192680",
"290057040409906632135209571705677512677",
"103422757099225017077492036398374625022"
],
"threshold": 0.9
},
"id": "CVE-2016-9754-b229655d",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "kernel/trace/ring_buffer.c"
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9754.json"
[
{
"source": "https://github.com/torvalds/linux/commit/59643d1535eb220668692a5359de22545af579f6",
"digest": {
"length": 2589.0,
"function_hash": "290750522883156964132839019910174695988"
},
"id": "CVE-2016-9754-1b97a377",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "kernel/trace/ring_buffer.c",
"function": "ring_buffer_resize"
}
},
{
"source": "https://github.com/torvalds/linux/commit/59643d1535eb220668692a5359de22545af579f6",
"digest": {
"line_hashes": [
"38999631357087133190610000041246712044",
"247142704931748006276282255321837882192",
"51949467991174106505023942127430155596",
"246426195170731150658828107860383155347",
"269930116332395430356628380906952823394",
"238930258180314091852747116444582192680",
"290057040409906632135209571705677512677",
"103422757099225017077492036398374625022"
],
"threshold": 0.9
},
"id": "CVE-2016-9754-76929cb7",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "kernel/trace/ring_buffer.c"
}
}
]