PT-2016-5665

CVE-2016-3699

Published

2016-10-07

Updated

2023-02-13

Description by

CVSS 3.1

7.4

High

MetricsAV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2

Description The issue allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd when the system is booted with UEFI Secure Boot enabled.

Recommendations For Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2, consider disabling UEFI Secure Boot or restricting the appending of ACPI tables to the initrd until a patch is available.

Exploitability

Exploit

Fix

Researchers

Linn Crosetto

Vladis Dronov

Vendors

Affected products

Weakness enumeration

CWE-264

Related identifiers

CVE-2016-3699