Bug 1375944 (CVE-2016-7039)

Summary:	CVE-2016-7039 kernel: remotely triggerable unbounded recursion in the vlan gro code leading to a kernel crash
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	agordeev, aquini, bhu, carnil, dhoward, esammons, fhrbata, fwestpha, gitbot-kernelmantain-xmlrpc, hsowa, iboverma, jbenc, jcm, jkacur, jross, kernel-mgr, lgoncalv, lwang, matt, mcressma, mguzik, mleitner, nmurray, plougher, pmatouse, ppandit, rkhan, rvrbovsk, sardella, sdubroca, security-response-team, sukulkar, Thomas.Doczkal, williams, yozone, yselkowi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area Network(CONFIG_VXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path, as an unlimited recursion could unfold in both VLAN and TEB modules, leading to a stack corruption in the kernel.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-09-05 05:04:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1374191, 1378405, 1379913, 1379914, 1379920, 1383476, 1387549, 1422645
Bug Blocks:	1375945

Description Adam Mariš 2016-09-14 09:58:40 UTC

Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area Network(CONFIG_VXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path; As an unlimited recursion could unfold in both VLAN and TEB modules, leading to a stack corruption in the kernel.

A remote user could use this falw to cause kernel panic by sending maliciously crafted packets to a server that has GRO enabled.

Additional requirement for attacking VLAN is to have 8021q module loaded.
Additional requirement for attacking TEB is to have increased MTU.

Upstream patch
---------------
  -> https://patchwork.ozlabs.org/patch/680412/

Comment 9 Prasad Pandit 2016-10-10 18:08:46 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1383476]

Comment 10 errata-xmlrpc 2016-10-10 23:07:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2047 https://rhn.redhat.com/errata/RHSA-2016-2047.html

Comment 12 errata-xmlrpc 2016-10-26 10:47:46 UTC

This issue has been addressed in the following products:

  MRG for RHEL-6 v.2

Via RHSA-2016:2107 https://rhn.redhat.com/errata/RHSA-2016-2107.html

Comment 13 errata-xmlrpc 2016-10-26 12:22:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2110 https://rhn.redhat.com/errata/RHSA-2016-2110.html

Comment 19 errata-xmlrpc 2017-03-02 17:08:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0372 https://rhn.redhat.com/errata/RHSA-2017-0372.html