Is CVE-2016-4558 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 1%.

What products does CVE-2016-4558 affect?

Tracked products affected include Ubuntu. Check the version you run to see whether it is affected.

How do I fix CVE-2016-4558?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2016-4558

Q: What is CVE-2016-4558?

CVE-2016-4558 is a high-severity software vulnerability with a CVSS score of 7. The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted application on (1) a system with

HIGH severity · CVSS 7

7CVSS HIGH

Summary

The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted application on (1) a system with more than 32 Gb of memory, related to the program reference count or (2) a 1 Tb system, related to the map reference count.

Impact & exploitability

Attack vectorLocal

Attack complexityHigh

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)1%

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Ubuntu

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=92117d8443bc5afacc8d5ba82e541946310f106eAdvisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.5.5Advisory
https://github.com/torvalds/linux/commit/92117d8443bc5afacc8d5ba82e541946310f106eAdvisory
http://www.openwall.com/lists/oss-security/2016/05/06/4Advisory
http://www.ubuntu.com/usn/USN-3005-1Advisory
http://www.ubuntu.com/usn/USN-3006-1Advisory
http://www.ubuntu.com/usn/USN-3007-1Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1334303Advisory