{"id":"CVE-2016-0774","details":"The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in a certain Linux kernel backport in the linux package before 3.2.73-2+deb7u3 on Debian wheezy and the kernel package before 3.10.0-229.26.2 on Red Hat Enterprise Linux (RHEL) 7.1 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an \"I/O vector array overrun.\" NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-1805.","modified":"2026-03-15T22:02:54.889787Z","published":"2016-04-27T17:59:06.117Z","related":["CGA-6vcj-8hj2-gmwp","SUSE-SU-2016:0785-1","SUSE-SU-2016:1031-1","SUSE-SU-2016:1032-1","SUSE-SU-2016:1033-1","SUSE-SU-2016:1034-1","SUSE-SU-2016:1035-1","SUSE-SU-2016:1037-1","SUSE-SU-2016:1038-1","SUSE-SU-2016:1039-1","SUSE-SU-2016:1040-1","SUSE-SU-2016:1041-1","SUSE-SU-2016:1045-1","SUSE-SU-2016:1046-1"],"references":[{"type":"WEB","url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00025.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00027.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00029.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00031.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00036.html"},{"type":"WEB","url":"http://www.securityfocus.com/bid/84126"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00026.html"},{"type":"WEB","url":"https://security-tracker.debian.org/tracker/CVE-2016-0774"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00037.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00030.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00032.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00034.html"},{"type":"WEB","url":"http://source.android.com/security/bulletin/2016-05-01.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00028.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00033.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-0617.html"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3503"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2967-1"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2967-2"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2968-1"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2968-2"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-0494.html"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1303961"}],"affected":[{"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-0774.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"6.0.1"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}]}