CVE-2016-8733 Integer overflow in SmartOS

High 7.8 Published 14 Dec 2016 Updated 6 Aug 2024

An integer overflow in the Hyprlofs file system allows attackers to cause a kernel panic or potentially escalate privileges via a crafted ioctl call.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2016-8733?

CVE-2016-8733 is a high-severity vulnerability in Joyent SmartOS, published on 14 Dec 2016. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An exploitable integer overflow exists in the Joyent SmartOS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFS_ADD_ENTRIES when dealing with native file systems. An attacker can craft an input that can cause a kernel panic and potentially be leveraged into a full privilege escalation vulnerability. This vulnerability is distinct from CVE-2016-9031.

Weakness: CWE-190

Which versions are affected by CVE-2016-8733?

It affects 1 product.

Products include Joyent Smartos.

How do I fix CVE-2016-8733?

No fix has been published for CVE-2016-8733 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-8733 being exploited?

There is no known exploitation of CVE-2016-8733 in the wild and no public exploit code.

Sources

Also known as GHSA-9gx4-xhr5-rc9m.