CVE-2016-10088 Amazon Linux Security Advisory for kernel: ALAS-2017-786

<DIV ID="issue_overview"> Issue Overview:

The sg implementation in the Linux kernel did not properly restrict write operations in situations where the KERNEL_DS option is set, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device, related to block/bsg.c and drivers/scsi/sg.c. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-9576 .

</DIV>

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2017-786 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2017-786: Amazon Linux (kernel (4.4.41-36.55.amzn1) on noarch)

ALAS-2017-786: Amazon Linux (kernel (4.4.41-36.55.amzn1) on x86_64)

ALAS-2017-786: Amazon Linux (kernel (4.4.41-36.55.amzn1) on src)

ALAS-2017-786: Amazon Linux (kernel (4.4.41-36.55.amzn1) on i686)