Bug 702303 (CVE-2011-1767, CVE-2011-1768)

Summary:	CVE-2011-1767 CVE-2011-1768 kernel: netns vs proto registration ordering
Product:	[Other] Security Response	Reporter:	Petr Matousek <pmatouse>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	arozansk, bhu, davej, fhrbata, jkacur, kernel-mgr, kmcmartin, lgoncalv, lwang, rt-maint, sforsber, tcallawa, williams, wmealing
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-11-11 02:11:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	702305, 702306, 702307
Bug Blocks:

Description Petr Matousek 2011-05-05 10:22:20 UTC

Description:
1) CVE-2011-1767
gre: fix netns vs proto registration ordering

GRE protocol receive hook can be called right after protocol addition is done.
If netns stuff is not yet initialized, we're going to oops in
net_generic().

This is remotely oopsable if ip_gre is compiled as module and packet
comes at unfortunate moment of module loading.

Upstream commit:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c2892f02

References:
http://www.openwall.com/lists/oss-security/2010/02/18/3
http://patchwork.ozlabs.org/patch/45553/

2) CVE-2011-1768
tunnels: fix netns vs proto registration ordering

Same stuff as in ip_gre patch: receive hook can be called before netns
setup is done, oopsing in net_generic().

Upstream commit:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=d5aa407f

References:
http://www.openwall.com/lists/oss-security/2010/02/18/3
http://patchwork.ozlabs.org/patch/45554/

Comment 3 Eugene Teo (Security Response) 2011-05-06 01:06:47 UTC

Statement:

The Linux kernel as shipped with Red Hat Enterprise Linux 4, and 5 did not provide support for Network Namespace, and therefore are not affected by this issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0928.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html.

Comment 4 Eugene Teo (Security Response) 2011-05-06 01:07:58 UTC

Note that for this issue to occur, packets have to come when the module is loading, the window for this to happen is small.

Comment 7 errata-xmlrpc 2011-07-12 21:12:00 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2011:0928 https://rhn.redhat.com/errata/RHSA-2011-0928.html

Comment 8 Eugene Teo (Security Response) 2011-08-29 04:38:46 UTC

> 2) CVE-2011-1768
> tunnels: fix netns vs proto registration ordering
> 
> Same stuff as in ip_gre patch: receive hook can be called before netns
> setup is done, oopsing in net_generic().

A regression was found that can result in a NULL pointer dereference when the ip6_tunnel module is loaded, http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=633738.

Filed bugs:
Bug 733985 - kernel: regression in CVE-2011-1768 fix [rhel-6.2]
Bug 733986 - kernel: regression in CVE-2011-1768 fix [mrg-2.0]

Comment 9 errata-xmlrpc 2011-09-12 19:45:22 UTC

This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2011:1253 https://rhn.redhat.com/errata/RHSA-2011-1253.html