Bug 1317571 (CVE-2016-0821)

Summary: CVE-2016-0821 kernel: Too big poison pointer space
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aquini, bhu, dhoward, fhrbata, gansalmon, iboverma, itamar, jforbes, jkacur, joelsmith, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, kstutsma, lgoncalv, madhu.chinakonda, mchehab, mcressma, nmurray, rt-maint, rvrbovsk, slawomir, vdronov, williams, wmealing
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 4.3 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-21 00:51:04 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1317580, 1343802    

Description Adam Mariš 2016-03-14 15:15:47 UTC 
The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3 not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialised list entry.

This is an issue in a security mechanism, not a mechanism for leverage an attack from.  

Upstream patch:

https://github.com/torvalds/linux/commit/8a5e5e02fc83aaf67053ab53b359af08c6c49aaf

Disclosure:
http://www.openwall.com/lists/oss-security/2015/05/02/6
Comment 1 Wade Mealing 2016-04-15 09:09:22 UTC 
Statement:

This issue affects versions of the kernel shipped with Red Hat Enterprise
Linux 5, 6, 7 and MRG-2 realtime kernels.

This has been rated as having Moderate security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/ .