CVE-2016-6136

What it actually does

Race condition (double-fetch) in audit_log_single_execve_arg allows a local process to alter a string between kernel fetches, bypassing character-set filtering or corrupting audit records for execve arguments.

Why it matters to the business

Attackers on a compromised host can evade or corrupt system-call auditing, making malicious activity harder to detect and potentially violating compliance or forensic requirements on Linux systems.

How an attack unfolds

A local attacker prepares an execve call with a carefully chosen string, races the kernel's two accesses to that string in audit_log_single_execve_arg, and either bypasses filtering or injects invalid data into the audit log.

How to fix it

Upgrade the Linux kernel to a version containing commit 43761473c254b45883a64441dd0bc85a42f3645c or later; rebuild and reboot all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 43761473c254b45883a64441dd0bc85a42f3645c; review audit logs for malformed or unexpected execve argument entries during testing.

Typical attack path

1. Obtain local user or process execution on a vulnerable Linux kernel
2. Craft an execve argument containing bytes that trigger the double-fetch window
3. Time the modification of the user-space string between the two kernel reads
4. Observe bypassed restrictions or corrupted audit entries

How to detect it

Search kernel audit logs for execve records containing unexpected or truncated argument strings; correlate with process activity that modifies memory between system calls.

What your security team should do

• Apply the referenced kernel commit or a current distribution update as soon as possible
• Review audit configuration to ensure execve arguments remain logged even if character-set checks are bypassed
• Monitor for unusual execve audit records as an interim detection measure