Bug 1033593 (CVE-2013-6380)

Summary: CVE-2013-6380 Kernel: aacraid: invalid pointer dereference
Product: [Other] Security Response Reporter: Prasad Pandit <ppandit>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: pmatouse, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-11-26 11:54:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1034293, 1034294, 1034295, 1034299, 1034301, 1034302, 1034303, 1034304    
Bug Blocks: 1033586    

Description Prasad Pandit 2013-11-22 12:53:51 UTC
Linux kernel built with a Adaptec RAID controllers support(CONFIG_SCSI_AACRAID)
is vulnerable to a invalid pointer dereference flaw. It could occur while doing an ioctl(2) call with a FSACTL_SEND_RAW_SRB command.

A privileged(CAP_SYS_ADMIN) user/program could use this flaw to make kernel dereference invalid pointer which results in kernel crash (DoS) or could, potentially, result in privilege escalation.

Upstream fix:
-------------
  -> https://git.kernel.org/linus/b4789b8e6be3151a955ade74872822f30e8cd914

Reference:
----------
 -> http://seclists.org/oss-sec/2013/q4/330

Comment 1 Prasad Pandit 2013-11-25 14:39:21 UTC
nt

Comment 4 Prasad Pandit 2013-11-25 14:52:11 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1034304]

Comment 5 Petr Matousek 2013-11-26 11:54:21 UTC
Statement:

The Red Hat Security Response Team does not consider this issue to be a security flaw due to the full root-like privileges (CAP_SYS_ADMIN) needed for successful exploitation.

Comment 6 Fedora Update System 2013-12-04 16:50:56 UTC
kernel-3.11.10-300.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2013-12-07 06:58:20 UTC
kernel-3.11.10-200.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2013-12-10 06:16:24 UTC
kernel-3.11.10-100.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.