CVE-2016-3695

Description

The einj_error_inject function in drivers/acpi/apei/einj.c in the Linux kernel allows local users to simulate hardware errors and consequently cause a denial of service by leveraging failure to disable APEI error injection through EINJ when securelevel is set.

CVSS Metrics

• v3.0•MEDIUM•Score: 5.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• v2.0•LOW•Score: 2.1AV:L/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.06%• Percentile: 18%

Techniques & Countermeasures

• CWE-74•Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Systems

• linux•linux_kernel

  na

• redhat•enterprise_linux

  7.0

References (3)

• https://bugzilla.redhat.com/show_bug.cgi?id=1322755
• http://www.securityfocus.com/bid/102327
• https://github.com/mjg59/linux/commit/d7a6be58edc01b1c66ecd8fcc91236bfbce0a420