CVE-2016-10088

What it actually does

The sg driver in the Linux kernel fails to enforce proper restrictions on write operations when KERNEL_DS is set, enabling local users to read or write arbitrary kernel memory locations or trigger a use-after-free condition via /dev/sg access.

Why it matters to the business

Local attackers can escalate privileges, read sensitive kernel data, or crash affected systems, leading to potential data breaches, service disruption, and loss of system integrity on Linux hosts.

How an attack unfolds

An attacker with local access opens a /dev/sg device, sets KERNEL_DS, and issues crafted write operations that bypass intended restrictions, leveraging the incomplete prior fix to corrupt kernel memory or trigger use-after-free for privilege escalation or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing commit 128394eff343fc6d2f32172f03e24829539c5835 or later; restrict unprivileged access to /dev/sg devices until patched.

How to confirm the fix worked

Verify the running kernel includes commit 128394eff343fc6d2f32172f03e24829539c5835; test that writes through /dev/sg with KERNEL_DS no longer allow arbitrary memory access.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Open a handle to /dev/sg
3. Set KERNEL_DS and issue malicious write operations
4. Read or write arbitrary kernel memory or trigger use-after-free
5. Escalate privileges or cause denial of service

How to detect it

Review kernel logs for sg driver oops or use-after-free warnings; audit processes opening /dev/sg with elevated capabilities; search for unexpected memory access patterns in kernel traces.

• /dev/sg
• drivers/scsi/sg.c
• block/bsg.c
• KERNEL_DS

What your security team should do

• Apply the referenced kernel commit or distribution update as soon as possible
• Limit access to /dev/sg via permissions or device whitelisting
• Monitor for local privilege-escalation attempts targeting the sg driver
• Review systems for any custom sg device usage that may increase exposure