CVE-2016-10723 Denial of service in n/a
A local unprivileged user can cause a permanent system lockup by exhausting CPU resources during OOM killer events due to missing yield in the page allocator.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-10723?
CVE-2016-10723 is a medium-severity denial of service vulnerability in Linux kernel, published on 21 Jun 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in the Linux kernel through 4.17.2. Since the page allocator does not yield CPU resources to the owner of the oom_lock mutex, a local unprivileged user can trivially lock up the system forever by wasting CPU resources from the page allocator (e.g., via concurrent page fault events) when the global OOM killer is invoked. NOTE: the software maintainer has not accepted certain proposed patches, in part because of a viewpoint that "the underlying problem is non-trivial to handle.
Weakness: CWE-399
Which versions are affected by CVE-2016-10723?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2016-10723?
No fix published yet.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-10723 being exploited?
There is no known exploitation of CVE-2016-10723 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2016-10723, DEBIAN-CVE-2016-10723, GHSA-425g-hgx9-r6jq, ROOT-OS-DEBIAN-12-CVE-2016-10723, ROOT-OS-DEBIAN-13-CVE-2016-10723, UBUNTU-CVE-2016-10723.