CVE-2016-6136 in Android

Summary

Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Reservation

07/01/2016

Disclosure

08/06/2016

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
93491	Google Android Kernel System-Call Auditing race condition	362	Not defined	Official fix	CVE-2016-6136
90643	Linux Kernel auditsc.c audit_log_single_execve_arg race condition	362	Not defined	Official fix	CVE-2016-6136

Sources

• MITRE
• NVD
• CVE Details