Bug 1390832 (CVE-2016-8632)
|Summary:||CVE-2016-8632 kernel: TIPC subsystem: tipc_msg_build() doesn't validate MTU, may cause memory corruption.|
|Product:||[Other] Security Response||Reporter:||Wade Mealing <wmealing>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED NOTABUG||QA Contact:|
|Version:||unspecified||CC:||carnil, john.haxby, security-response-team, tyrande000, vdronov|
|Fixed In Version:||Doc Type:||If docs needed, set a value|
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible privilege escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. An attacker could create a packet which will overwrite memory outside of allocated space and allow for privilege escalation.
|Last Closed:||2019-06-08 03:01:46 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:||1392262|
Description Wade Mealing 2016-11-02 03:52:10 UTC
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. Not all devices support or allow MTU's below 68 octets. An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation. The affected code is not enabled on Red Hat Enterprise Linux 6 and 7. The affected code was not included in Red Hat Enterprise Linux 5. Initial patch: https://email@example.com/msg133205.html
Comment 1 Wade Mealing 2016-11-02 03:55:43 UTC
Acknowledgement: Red Hat would like to thank Qian Zhang from Qihoo 360 Marvel Team for reporting this issue.
Comment 2 Wade Mealing 2016-11-02 05:56:37 UTC
Statement: This issue is rated as important. The affected code is not enabled on Red Hat Enterprise Linux 6 and 7 or MRG-2 kernels. The commit introducing the comment was not included in Red Hat Enterprise Linux 5.
Comment 4 Wade Mealing 2016-11-07 02:57:08 UTC
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1392262]