Bug 1421981 (CVE-2016-8636)

Summary:	CVE-2016-8636 kernel: Integer overflow in the RDMA over infiniband software implementation
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agordeev, aquini, bhu, dhoward, esammons, fhrbata, gansalmon, iboverma, ichavero, itamar, jforbes, jkacur, jkastner, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, lwang, madhu.chinakonda, matt, mchehab, mcressma, mguzik, nmurray, pholasek, plougher, rt-maint, rvrbovsk, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-02-14 09:24:20 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Andrej Nemec 2017-02-14 09:22:35 UTC

An integer overflow vulnerability was found in the Linux kernel in the software implementation of the RDMA protocol over infiniband.

References:

http://seclists.org/oss-sec/2017/q1/404
https://eyalitkin.wordpress.com/2017/02/11/cve-publication-cve-2016-8636/

Upstream patch:

https://github.com/torvalds/linux/commit/647bf3d8a8e5777319da92af672289b2a6c4dc66

Comment 1 Andrej Nemec 2017-02-14 09:24:20 UTC

Statement:

This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux as they did not include the software implementation of the RDMA protocol over infiniband.