Bug 1399528 (CVE-2016-9644)

Summary:	CVE-2016-9644 kernel: Incorrect fix for CVE-2016-9178
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	agordeev, aquini, arm-mgr, bhu, dhoward, esammons, fhrbata, gansalmon, iboverma, ichavero, itamar, jforbes, jkacur, jkastner, joelsmith, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, lwang, madhu.chinakonda, matt, mchehab, mcressma, mguzik, nmurray, pholasek, plougher, rt-maint, rvrbovsk, vdronov, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-29 09:17:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	1415125
Bug Blocks:

Description Andrej Nemec 2016-11-29 09:16:01 UTC

The __get_user_asm_ex macro in arch/x86/include/asm/uaccess.h in the Linux
kernel 4.4.22 through 4.4.28 contains extended asm statements that are
incompatible with the exception table, which allows local users to obtain root
access on non-SMEP platforms via a crafted application.  NOTE: this
vulnerability exists because of incorrect backporting of the CVE-2016-9178 patch
to older kernels.

Above refers to a new issue which affected some Linux stable lines, which backported 1c109fabbd51863475cd12ac206bdd249aee35af without also backporting 548acf19234dbda5a52d5a8e7e205af46e9da840.

References:

http://seclists.org/oss-sec/2016/q4/535
https://lwn.net/Articles/705264/

Upstream patches:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1c109fabbd51863475cd12ac206bdd249aee35af
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=548acf19234dbda5a52d5a8e7e205af46e9da840

Comment 2 Vladis Dronov 2017-01-20 10:51:47 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1415125]