NVD Vulnerability Detail

CVE-2016-10225

Summary	The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxi_debug/sunxi_debug.
Publication Date	March 28, 2017, 2:59 a.m.
Registration Date	Jan. 26, 2021, 2:05 p.m.
Last Update	Nov. 21, 2024, 11:43 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2016/10/05/16	Mailing List Patch Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2016/10/05/16	Mailing List Patch Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2017/02/15/9	Mailing List Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2017/02/15/9	Mailing List Third Party Advisory
5	http://www.securityfocus.com/bid/93442	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/93442	Third Party Advisory VDB Entry
7	https://forum.armbian.com/index.php?/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/	Mailing List Third Party Advisory
8	https://forum.armbian.com/index.php?/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/	Mailing List Third Party Advisory
9	https://irclog.whitequark.org/linux-sunxi/2016-04-29#16314390	Issue Tracking Third Party Advisory
10	https://irclog.whitequark.org/linux-sunxi/2016-04-29#16314390	Issue Tracking Third Party Advisory
11	https://www.rapid7.com/db/modules/exploit/multi/local/allwinner_backdoor	Exploit Third Party Advisory
12	https://www.rapid7.com/db/modules/exploit/multi/local/allwinner_backdoor	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Allwinner レガシーカーネルの sunxi-debug ドライバにおける root 権限を取得される脆弱性

Title	Allwinner レガシーカーネルの sunxi-debug ドライバにおける root 権限を取得される脆弱性
Summary	Allwinner レガシーカーネルの sunxi-debug ドライバには、root 権限を取得される脆弱性が存在します。
Possible impacts	ローカルユーザにより、"rootmydevice" を /proc/sunxi_debug/sunxi_debug に送信されることで、root 権限を取得される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	May 2, 2016, midnight
Registration Date	April 27, 2017, 4:19 p.m.
Last Update	April 27, 2017, 4:19 p.m.

Affected System

Allwinner Technology Co. Ltd.

Linux 3.4 sunxi

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-10225	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10225
National Vulnerability Database (NVD)
2	CVE-2016-10225	https://nvd.nist.gov/vuln/detail/CVE-2016-10225

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Allwinner
1	Top Page	http://www.allwinnertech.com/

その他

No	Name	URL
関連文書
1	CVE request: sunxi-debug (root privilege escalation in Allwinner kernel)	http://www.openwall.com/lists/oss-security/2016/10/05/16
2	Security Alert for Allwinner sun8i (H3/A83T/H8)	https://forum.armbian.com/index.php?/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/

Change Log

No	Changed Details	Date of change
0	[2017年04月27日] 掲載	Feb. 17, 2018, 10:37 a.m.