Bug 1441088 (CVE-2017-7616)

Summary:	CVE-2017-7616 kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aquini, bhu, dhoward, fhrbata, gansalmon, hwkernel-mgr, iboverma, ichavero, itamar, jcm, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, madhu.chinakonda, matt, mchehab, mcressma, nmurray, pholasek, plougher, rt-maint, rvrbovsk, slawomir, vdronov, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	Incorrect error handling in the set_mempolicy() and mbind() compat syscalls in 'mm/mempolicy.c' in the Linux kernel allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:10:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1441095, 1443539, 1443541, 1443543, 1443545, 1443547
Bug Blocks:	1441097

Description Andrej Nemec 2017-04-11 08:20:11 UTC

Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation. 

Advisory:

https://nvd.nist.gov/vuln/detail/CVE-2017-7616

Detailed analysis:

https://grsecurity.net/the_infoleak_that_mostly_wasnt.php

Upstream patch:

https://github.com/torvalds/linux/commit/cf01fb9985e8deb25ccf0ea54d916b8871ae0e62

Comment 1 Andrej Nemec 2017-04-11 08:26:08 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1441095]

Comment 10 Vladis Dronov 2017-04-26 17:33:55 UTC

Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 on ppc64 and ppc64le platforms. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6 and 7 on ppc64 and ppc64le platforms. Future Linux kernel updates for the respective releases might address this issue.

Only ppc64 and ppc64le hardware platforms are vulnerable. The Linux kernel packages for other platforms which Red Hat ships (i386, x86_64, s390x) are not vulnerable to this security flaw.

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux MRG-2 as this product is shipped for x86_64 hardware platform only.

Comment 11 errata-xmlrpc 2017-08-01 19:15:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2077

Comment 12 errata-xmlrpc 2017-08-02 07:55:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:1842

Comment 14 errata-xmlrpc 2018-06-19 04:49:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1854 https://access.redhat.com/errata/RHSA-2018:1854