Bug 1353538 (CVE-2016-6162)

Summary:	CVE-2016-6162 kernel: Kernel panic triggered at BUG_ON in net/core/skbuff.c
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aquini, arm-mgr, bhu, dhoward, egarver, fhrbata, gansalmon, iboverma, itamar, jforbes, jkacur, joelsmith, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, kstutsma, lgoncalv, madhu.chinakonda, matt, mchehab, mcressma, nmurray, plougher, rt-maint, rvrbovsk, slawomir, vdronov, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	The code in the net/core/skbuff.c in the Linux kernel allows local users to cause a denial of service (a system panic) or possibly have unspecified other impact via certain IPv6 socket operations.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-04-18 22:29:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1353539
Bug Blocks:	1699356

Description Adam Mariš 2016-07-07 12:08:20 UTC

The code in the net/core/skbuff.c in the Linux kernel allows local users to cause a denial of service (a system panic) or possibly have unspecified other impact via certain IPv6 socket operations.

Reference (contains reproducer):

http://seclists.org/oss-sec/2016/q3/8

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a612769774a3

Comment 1 Adam Mariš 2016-07-07 12:09:00 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1353539]

Comment 4 Justin M. Forbes 2017-06-21 18:08:27 UTC

This fix has been in Fedora for a long time now.

Comment 7 Vladis Dronov 2019-04-18 22:29:57 UTC

Note:

Red Hat Enterprise Linux 7 is not vulnerable to this flaw as only a part of offending commit e6afc8ace6dd without the bug was backported. Other Red Hat products are not affected also, as either the bug is fully fixed or offending code is not present.