CVE-2016-7042

What it actually does

Incorrect buffer size in proc_keys_show causes stack memory corruption when writing timeout data under gcc stack protector, resulting in kernel panic on read of /proc/keys.

Why it matters to the business

Local users can trigger system crashes leading to unplanned downtime and potential loss of in-memory data on affected Linux systems.

How an attack unfolds

A local attacker reads the /proc/keys file, triggering the oversized write in proc_keys_show that overflows the stack buffer and panics the kernel.

How to fix it

Upgrade the Linux kernel to a version beyond 4.8.2 that corrects the buffer size calculation in security/keys/proc.c; apply vendor-supplied patches if available.

How to confirm the fix worked

Confirm kernel version is newer than 4.8.2 and test that reading /proc/keys no longer causes a panic; review kernel source for the corrected snprintf or buffer length.

Typical attack path

1. Obtain local shell access on target system
2. Execute read operation against /proc/keys
3. Trigger stack corruption and kernel panic

How to detect it

Review system logs for kernel panic entries referencing proc_keys_show or stack protector violations around the time of /proc/keys access; examine audit logs for reads of that file by non-administrative users.

• proc_keys_show
• /proc/keys
• stack protector
• kernel panic

What your security team should do

• Prioritize kernel upgrades on all exposed systems
• Restrict unprivileged local access where feasible until patched
• Monitor for kernel panics correlated with /proc/keys access