Bug 1526427 (CVE-2017-17712)

Summary:	CVE-2017-17712 kernel: Race condition in raw_sendmsg function allows denial-of-service or kernel addresses leak
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	airlied, ajax, aquini, bhu, blc, bskeggs, dhoward, ewk, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jkacur, john.j5live, jonathan, josef, jross, jwboyer, kent, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, plougher, rt-maint, rvrbovsk, security-response-team, skozina, steved, vdronov, williams, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A flaw was found in the Linux kernel's implementation of raw_sendmsg allowing a local attacker to panic the kernel or possibly leak kernel addresses. A local attacker, with the privilege of creating raw sockets, can abuse a possible race condition when setting the socket option to allow the kernel to automatically create ip header values and thus potentially escalate their privileges.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 03:34:31 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1526933, 1527027, 1527028
Bug Blocks:	1525085

Description Adam Mariš 2017-12-15 12:43:09 UTC

A flaw was found in the kernels implementation of raw_sendmsg allowing a
local attacker to panic the kernel or possible leak kernel addresses. A
local attacker with the privilege of creating raw sockets, can abuse a
possible race condition when setting the socket option to allow the kernel
to automatically create ip header values.

References:

http://seclists.org/oss-sec/2017/q4/401

https://patchwork.ozlabs.org/patch/846641/

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8f659a03a0ba9289b9aeb9b4470e6fb263d6f483

Comment 3 Adam Mariš 2017-12-18 08:34:53 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1526933]

Comment 4 Petr Matousek 2017-12-18 11:42:49 UTC

Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2 as they do not contain the upstream commit (c008ba5bdc9f) that allows this issue to be exploited.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 for ARM and Red Hat Enterprise Linux for Power LE.

Future Linux kernel updates for the respective releases may address this issue.

Comment 5 Petr Matousek 2017-12-18 11:44:44 UTC

What is Red Hat Enterprise Linux 7 for ARM 64,
        Red Hat Enterprise Linux 7 for Power 9 LE

The kernel package as shipped with Red Hat Enterprise Linux 7 for ARM 64 and Red Hat Enterprise Linux 7 for Power 9 LE is an updated kernel intended to support new architectures not available at the time of Red Hat Enterprise Linux 7 original shipping. The new kernel version is based on an upstream Linux kernel version 4.11. The offering is distributed with other updated packages, but most of the userspace is the standard Red Hat Enterprise Linux 7 Server RPM files.

For more information please refer to:

https://access.redhat.com/articles/3158541
https://access.redhat.com/articles/3158511

Comment 9 errata-xmlrpc 2018-03-13 15:37:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:0502 https://access.redhat.com/errata/RHSA-2018:0502