Bug 1390832 (CVE-2016-8632)

Summary:	CVE-2016-8632 kernel: TIPC subsystem: tipc_msg_build() doesn't validate MTU, may cause memory corruption.
Product:	[Other] Security Response	Reporter:	Wade Mealing <wmealing>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	carnil, john.haxby, security-response-team, tyrande000, vdronov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible privilege escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. An attacker could create a packet which will overwrite memory outside of allocated space and allow for privilege escalation.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:01:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1392262
Bug Blocks:	1384811

Description Wade Mealing 2016-11-02 03:52:10 UTC

A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation.  The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol.  Not all devices support or allow MTU's below 68 octets.

An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation.

The affected code is not enabled on Red Hat Enterprise Linux 6 and 7.  The affected code was not included in Red Hat Enterprise Linux 5.

Initial patch:
 https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html

Comment 1 Wade Mealing 2016-11-02 03:55:43 UTC

Acknowledgement:

Red Hat would like to thank Qian Zhang from Qihoo 360 Marvel Team for reporting this issue.

Comment 2 Wade Mealing 2016-11-02 05:56:37 UTC

Statement:

This issue is rated as important.  The affected code is not enabled on Red Hat Enterprise Linux 6 and 7 or MRG-2 kernels.  The commit introducing the comment was not included in Red Hat Enterprise Linux 5.

Comment 4 Wade Mealing 2016-11-07 02:57:08 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1392262]

Comment 5 Andrej Nemec 2016-11-08 13:22:47 UTC

References:

http://seclists.org/oss-sec/2016/q4/359