Resource exhaustion in Joyent Smartos
CVE-2016-9040
An exploitable denial of service exists in the the Joyent SmartOS OS 20161110T013148Z Hyprlofs file system. The vulnerability is present in the Ioctl system call with the command HYPRLOFSADDENTRIES when used with a 32 bit model. An attacker can cause a buffer to be allocated and never freed. When repeatedly exploit this will result in memory exhaustion, resulting in a full system denial of service.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (40.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 40.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Joyent Smartos — versions 20161110t013148z, 20161110T013148Z
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.talosintelligence.com/vulnerability_reports/TALOS-2016-0258 (Technical Description, Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2016-9040?
- CVE-2016-9040 is a medium-severity vulnerability in Joyent Smartos, classified under Uncontrolled Resource Consumption. CVSS score: 5.5/10. Published 2018-09-07.
- How severe is CVE-2016-9040?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2016-9040 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.