Bug 1445207 (CVE-2017-7477)

Summary: CVE-2017-7477 kernel: net: Heap overflow in skb_to_sgvec in macsec.c
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: agordeev, aquini, bhu, cperry, dhoward, esammons, fhrbata, gansalmon, hwkernel-mgr, iboverma, ichavero, itamar, Jason, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, kolshanov, labbott, lgoncalv, lwang, madhu.chinakonda, matt, mchehab, mcressma, mguzik, nmurray, pholasek, plougher, pmatouse, ppandit, rt-maint, rvrbovsk, slawomir, slong, williams, wmealing
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A flaw was found in the way Linux kernel allocates heap memory to build the scattergather list from a fragment list(skb_shinfo(skb)->frag_list) in the socket buffer(skb_buff). The heap overflow occurred if 'MAX_SKB_FRAGS + 1' parameter and 'NETIF_F_FRAGLIST' feature are both used together. A remote user or process could use this flaw to potentially escalate their privilege on a system.
Story Points: ---
Clone Of: Environment:
Last Closed: 2017-09-05 05:07:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1445208, 1445545, 1445546, 1445547, 1445548, 1445549    
Bug Blocks: 1445173    

Description Andrej Nemec 2017-04-25 09:10:38 UTC
A heap overflow vulnerability was found in the Linux kernel in macsec module. Specifying MAX_SKB_FRAGS + 1 and using NETIF_F_FRAGLIST which calls skb_to_sgvec will overflow the heap.

Upstream patches:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b

Comment 1 Andrej Nemec 2017-04-25 09:11:27 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1445208]

Comment 2 Andrej Nemec 2017-04-25 09:38:00 UTC
References:

http://seclists.org/oss-sec/2017/q2/119

Comment 3 Jason A. Donenfeld 2017-04-25 12:37:30 UTC
I found this vulnerability and reported it prior to oss-sec. The original email to oss-sec is here:

http://www.openwall.com/lists/oss-security/2017/04/24/4

The LKML discussion took place here:

https://lkml.org/lkml/2017/4/21/689

Comment 4 Petr Matousek 2017-04-25 14:02:41 UTC
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 starting with the version kernel-3.10.0-514.el7, that is with Red Hat Enterprise Linux 7.3 GA. Prior Red Hat Enterprise Linux 7 kernel versions are not affected.

In order to exploit this issue, the system needs to be manually configured by privileged user. The default Red Hat Enterprise Linux 7 configuration is not vulnerable.

Comment 7 Jason A. Donenfeld 2017-04-26 20:28:49 UTC
A subsequent upstream patch is here:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b

This *must* be applied to receive protection.

Comment 8 Wade Mealing 2017-04-27 00:36:08 UTC
Mitigation:

Red Hat recommends blacklisting the kernel module to prevent its use. This will prevent accidental version loading by administration and also mitigate the flaw if a kernel with the affected module is booted.

As the macsec module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions:
Raw

  # echo "install macsec /bin/true" >> /etc/modprobe.d/disable-macsec.conf 

If macsec functionality is in use as a functional part of the system a kernel upgrade is required.

Comment 9 errata-xmlrpc 2017-06-28 17:05:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1615 https://access.redhat.com/errata/RHSA-2017:1615

Comment 10 errata-xmlrpc 2017-06-28 17:08:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1616 https://access.redhat.com/errata/RHSA-2017:1616