Bug 1030800 (CVE-2013-4588)

Summary: CVE-2013-4588 Kernel: net: ipvs: stack buffer overflow
Product: [Other] Security Response Reporter: Prasad Pandit <ppandit>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: agordeev, anton, aquini, bhu, davej, dhoward, esammons, fhrbata, gansalmon, gbarros, iboverma, itamar, jforbes, jkacur, jkurik, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, lgoncalv, lwang, lxin, madhu.chinakonda, matt, mcressma, pholasek, plougher, pmatouse, rt-maint, rvrbovsk, security-response-team, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-02-05 12:07:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1030815, 1030816, 1030817, 1030818, 1052135    
Bug Blocks: 1029049    

Description Prasad Pandit 2013-11-15 07:27:57 UTC 
Linux kernel built with the IP Virtual Server(CONFIG_IP_VS) support is
vulnerable to a buffer overflow flaw. It could occur while setting or
retrieving socket options via setsockopt(2) or getsockopt(2) calls.
Though a user needs to have CAP_NET_ADMIN privileges to perform these IP_VS
operations.

A user/program with CAP_NET_ADMIN privileges could use this flaw to further escalate their privileges on a system.

Upstream fix:
-------------
 -> https://git.kernel.org/linus/04bcef2a83f40c6db24222b27a52892cba39dffb


UPDATE:
=======
The bounds check(below) added by the above patch are found to be redundant. The same are present in routine 'nf_sockopt_find'. [1]

  + if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
  +     return -EINVAL;
  + if (len < 0 || len > MAX_ARG_LEN)
  +     return -EINVAL;

[1] https://lkml.org/lkml/2009/9/30/265

That makes it a security non-issue.

Please see: -> http://seclists.org/oss-sec/2014/q1/174
Comment 1 Prasad Pandit 2013-11-15 07:35:05 UTC 
Statement:

The Red Hat Security Response Team does not consider this issue to be a security flaw.

Please see http://seclists.org/oss-sec/2014/q1/174 for CVE REJECT request and further information.