CVE-2016-6480

What it actually does

Race condition (double-fetch) in the aacraid driver's ioctl_send_fib handler permits a local attacker to alter a size value between kernel fetches, resulting in out-of-bounds memory access or kernel panic.

Why it matters to the business

Systems using the aacraid SCSI controller may experience unexpected crashes and service interruptions when a local user triggers the flaw; older unpatched kernels remain exposed years after disclosure.

How an attack unfolds

An attacker with local shell access opens the aacraid control device, prepares an ioctl buffer, and rapidly modifies the embedded size field between the two kernel reads performed by ioctl_send_fib, causing an out-of-bounds access or crash.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the double-fetch issue in drivers/scsi/aacraid/commctrl.c (post-4.7 stable branches and all subsequent releases). Rebuild and reboot with the patched kernel; disable the aacraid driver if hardware is not present.

How to confirm the fix worked

Confirm the running kernel version is newer than 4.7 and contains the upstream commit that eliminates the double fetch in ioctl_send_fib; attempt to reproduce the race under controlled conditions to verify the crash no longer occurs.

Typical attack path

1. Obtain local unprivileged shell on target Linux host
2. Locate /dev/aacraid or equivalent control device
3. Craft and repeatedly issue FIB ioctl calls while racing the size field
4. Trigger kernel oops or panic

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for aacraid-related oops or panic messages containing references to ioctl_send_fib or double-fetch patterns; correlate with user sessions that had access to storage ioctl devices.

What your security team should do

• Inventory all hosts using the aacraid driver and schedule immediate kernel updates
• Apply kernel live-patching where available for production systems that cannot reboot promptly
• Restrict local user access and monitor for unusual ioctl activity on storage control devices
• Remove the aacraid module if the hardware is not in use