Bug 1473649 (CVE-2017-7542)

Summary:	CVE-2017-7542 kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aquini, bhu, blc, carnil, dhoward, fhrbata, gansalmon, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, madhu.chinakonda, matt, mchehab, mcressma, mcroce, mlangsdo, nmurray, pholasek, plougher, rt-maint, rvrbovsk, sbrivio, slawomir, srikar.betarapalli, vdronov, williams, wmealing, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:17:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1473650, 1477005, 1477006, 1477007, 1477008, 1477009, 1477010, 1477011, 1477012, 1477013
Bug Blocks:	1473659

Description Adam Mariš 2017-07-21 11:50:37 UTC

Integer overflow vulnerability in ip6_find_1stfragopt() function was found. Local attacker that has privileges to open raw socket can cause infinite loop inside ip6_find_1stfragopt() function.

Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=6399f1fae4ec29fab5ec76070435555e256ca3a6

What is a denial of service:

https://access.redhat.com/denial-of-service-flaw-type

Comment 1 Adam Mariš 2017-07-21 11:51:23 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1473650]

Comment 14 Wade Mealing 2017-09-27 03:43:55 UTC

Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and does not qualify for inclusion as part of the Red Hat Enterprise Linux 5 lifecycle. For more information on the lifecycle see https://access.redhat.com/support/policy/updates/errata

Comment 16 errata-xmlrpc 2017-10-19 13:26:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2918

Comment 17 errata-xmlrpc 2017-10-19 15:06:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2930

Comment 18 errata-xmlrpc 2017-10-19 15:09:53 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2017:2931

Comment 20 errata-xmlrpc 2018-01-25 11:31:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:0169 https://access.redhat.com/errata/RHSA-2018:0169