CVE-2016-10044

What it actually does

The aio_mount function in fs/aio.c fails to properly restrict execute permissions, allowing local users to bypass SELinux W^X policy via the io_setup syscall and subsequently escalate privileges.

Why it matters to the business

Local attackers can obtain elevated privileges on affected Linux systems, increasing the risk of unauthorized access to sensitive data or full system control in environments relying on SELinux protections.

How an attack unfolds

A local attacker invokes the io_setup system call with crafted parameters that exploit the missing execute restriction in aio_mount, bypassing SELinux W^X enforcement to execute and gain higher privileges.

How to fix it

Update the Linux kernel to a version containing commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a or later; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Verify the running kernel version is 4.7.7 or newer, confirm the presence of commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a in the source tree, and test that io_setup no longer bypasses SELinux W^X.

Typical attack path

1. Obtain local user access on the target system
2. Invoke io_setup syscall with parameters targeting aio_mount
3. Trigger bypass of SELinux W^X policy restrictions
4. Execute code to escalate to higher privileges

How to detect it

Review system audit logs and SELinux AVC denials for patterns involving io_setup calls that unexpectedly succeed despite W^X policy; correlate with privilege changes in process execution history.

What your security team should do

• Prioritize kernel upgrade to the fixed version on all production systems
• Audit SELinux policies for reliance on W^X enforcement
• Enable enhanced auditing of aio and SELinux-related syscalls