CVE-2016-0728

What it actually does

Local users can trigger an integer overflow and use-after-free in the join_session_keyring function via crafted keyctl commands, leading to kernel privilege escalation or denial of service.

Why it matters to the business

Attackers with existing local access can obtain full system control or crash servers, enabling data theft, persistence, or widespread downtime on Linux systems; the long-public exploit increases risk for unpatched hosts.

How an attack unfolds

An attacker with local shell access issues specially crafted keyctl system calls that hit an error path in join_session_keyring, causing reference mishandling, integer overflow, and a use-after-free that is leveraged for code execution or kernel panic. Public exploits have been available since disclosure.

How to fix it

Upgrade the Linux kernel to a version containing commit 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 or later; apply vendor-supplied updates for all affected distributions and reboot systems.

How to confirm the fix worked

Verify the running kernel version includes the referenced commit or is newer than 4.4.1; inspect kernel source for the corrected join_session_keyring logic and run regression tests with keyctl operations.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Execute crafted keyctl commands targeting the join_session_keyring error path
3. Trigger integer overflow and use-after-free condition
4. Escalate privileges to root or cause kernel denial of service

How to detect it

Review audit logs and system call traces for anomalous keyctl invocations; search kernel logs for use-after-free warnings or crashes involving process_keys.c around the time of suspicious activity.

• keyctl.*join_session_keyring
• process_keys.c
• integer overflow.*keyring

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-user Linux hosts
• Restrict local user accounts and keyctl capabilities where possible
• Enable kernel hardening features such as SMEP and KASLR
• Monitor for new public exploits targeting this use-after-free