Bug 1445207 (CVE-2017-7477)
| Summary: | CVE-2017-7477 kernel: net: Heap overflow in skb_to_sgvec in macsec.c | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | agordeev, aquini, bhu, cperry, dhoward, esammons, fhrbata, gansalmon, hwkernel-mgr, iboverma, ichavero, itamar, Jason, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, kolshanov, labbott, lgoncalv, lwang, madhu.chinakonda, matt, mchehab, mcressma, mguzik, nmurray, pholasek, plougher, pmatouse, ppandit, rt-maint, rvrbovsk, slawomir, slong, williams, wmealing |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: |
A flaw was found in the way Linux kernel allocates heap memory to build the scattergather list from a fragment list(skb_shinfo(skb)->frag_list) in the socket buffer(skb_buff). The heap overflow occurred if 'MAX_SKB_FRAGS + 1' parameter and 'NETIF_F_FRAGLIST' feature are both used together. A remote user or process could use this flaw to potentially escalate their privilege on a system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-09-05 05:07:46 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1445208, 1445545, 1445546, 1445547, 1445548, 1445549 | ||
| Bug Blocks: | 1445173 | ||
|
Description
Andrej Nemec
2017-04-25 09:10:38 UTC
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1445208] References: http://seclists.org/oss-sec/2017/q2/119 I found this vulnerability and reported it prior to oss-sec. The original email to oss-sec is here: http://www.openwall.com/lists/oss-security/2017/04/24/4 The LKML discussion took place here: https://lkml.org/lkml/2017/4/21/689 Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2. This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 starting with the version kernel-3.10.0-514.el7, that is with Red Hat Enterprise Linux 7.3 GA. Prior Red Hat Enterprise Linux 7 kernel versions are not affected. In order to exploit this issue, the system needs to be manually configured by privileged user. The default Red Hat Enterprise Linux 7 configuration is not vulnerable. A subsequent upstream patch is here: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b This *must* be applied to receive protection. Mitigation: Red Hat recommends blacklisting the kernel module to prevent its use. This will prevent accidental version loading by administration and also mitigate the flaw if a kernel with the affected module is booted. As the macsec module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions: Raw # echo "install macsec /bin/true" >> /etc/modprobe.d/disable-macsec.conf If macsec functionality is in use as a functional part of the system a kernel upgrade is required. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:1615 https://access.redhat.com/errata/RHSA-2017:1615 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:1616 https://access.redhat.com/errata/RHSA-2017:1616 |