CVE-2016-2053: linux linux_kernel Cryptographic Issues

Modified

AliasesUBUNTU-CVE-2016-2053DEBIAN-CVE-2016-2053

Published 02-05-2016Last modified 05-08-2024

Vulnerability summary

CVE-2016-2053 is a medium (CVSS 4.7) Cryptographic Issues vulnerability in linux linux_kernel. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 41.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.7/10

010

Medium · v3.0 (NVD)

EPSS score

0.47%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

02-05-2016
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

The asn1_ber_decoder function in lib/asn1_decoder.c in the Linux kernel before 4.3 allows attackers to cause a denial of service (panic) via an ASN.1 BER file that lacks a public key, leading to mishandling by the public_key_verify_signature function in crypto/asymmetric_keys/public_key.c.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.04.7v2.04.7

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.47% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu4 products

linux< 3.13.0-83.127
linux-lts-utopic< 3.16.0-69.89~14.04.1
linux-lts-vivid< 3.19.0-56.62~14.04.1
linux-lts-wily< 4.2.0-35.40~14.04.1

Debian1 product

linux< 4.3.1-1

Linux1 product

linux_kernel< 4.3

3 vendors · 6 products

References

31 links

lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00022.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00023.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00017.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1300237X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
lists.opensuse.org/opensuse-security-announce/2016-08/msg00008.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00003.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00015.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00007.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory

Show all 31 references

lists.opensuse.org/opensuse-security-announce/2016-08/msg00019.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.openwall.com/lists/oss-security/2016/01/25/4Mailing ListX Refsource MLISTThird Party Advisory
github.com/torvalds/linux/commit/0d62e9dd6da45bbf0f33a8617afc5fe774c8f45fX Refsource CONFIRMPatchVendor Advisory
rhn.redhat.com/errata/RHSA-2016-2584.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00026.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-2574.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-06/msg00044.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
www.securitytracker.com/id/1036763VDB EntryX Refsource SECTRACKThird Party Advisory
git.kernel.org/cgit/…X Refsource CONFIRMVendor Advisory
lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00021.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00018.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00020.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00014.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00009.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00016.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
ubuntu.com/security/CVE-2016-2053REPORT
www.cve.org/CVERecord?id=CVE-2016-2053REPORT
security-tracker.debian.org/tracker/CVE-2016-2053Advisory