Bug 1421981 (CVE-2016-8636)

Summary: CVE-2016-8636 kernel: Integer overflow in the RDMA over infiniband software implementation
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: agordeev, aquini, bhu, dhoward, esammons, fhrbata, gansalmon, iboverma, ichavero, itamar, jforbes, jkacur, jkastner, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, lwang, madhu.chinakonda, matt, mchehab, mcressma, mguzik, nmurray, pholasek, plougher, rt-maint, rvrbovsk, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-02-14 09:24:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Andrej Nemec 2017-02-14 09:22:35 UTC
An integer overflow vulnerability was found in the Linux kernel in the software implementation of the RDMA protocol over infiniband.

References:

http://seclists.org/oss-sec/2017/q1/404
https://eyalitkin.wordpress.com/2017/02/11/cve-publication-cve-2016-8636/

Upstream patch:

https://github.com/torvalds/linux/commit/647bf3d8a8e5777319da92af672289b2a6c4dc66

Comment 1 Andrej Nemec 2017-02-14 09:24:20 UTC
Statement:

This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux as they did not include the software implementation of the RDMA protocol over infiniband.