Bug 1030800 - (CVE-2013-4588) CVE-2013-4588 Kernel: net: ipvs: stack buffer overflow
CVE-2013-4588 Kernel: net: ipvs: stack buffer overflow
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 1030815 1030816 1030817 1030818 1052135
Blocks: 1029049
  Show dependency treegraph
Reported: 2013-11-15 02:27 EST by Prasad J Pandit
Modified: 2016-03-04 07:14 EST (History)
34 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2014-02-05 07:07:14 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Prasad J Pandit 2013-11-15 02:27:57 EST
Linux kernel built with the IP Virtual Server(CONFIG_IP_VS) support is
vulnerable to a buffer overflow flaw. It could occur while setting or
retrieving socket options via setsockopt(2) or getsockopt(2) calls.
Though a user needs to have CAP_NET_ADMIN privileges to perform these IP_VS

A user/program with CAP_NET_ADMIN privileges could use this flaw to further escalate their privileges on a system.

Upstream fix:
 -> https://git.kernel.org/linus/04bcef2a83f40c6db24222b27a52892cba39dffb

The bounds check(below) added by the above patch are found to be redundant. The same are present in routine 'nf_sockopt_find'. [1]

  + if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
  +     return -EINVAL;
  + if (len < 0 || len > MAX_ARG_LEN)
  +     return -EINVAL;

[1] https://lkml.org/lkml/2009/9/30/265

That makes it a security non-issue.

Please see: -> http://seclists.org/oss-sec/2014/q1/174
Comment 1 Prasad J Pandit 2013-11-15 02:35:05 EST

The Red Hat Security Response Team does not consider this issue to be a security flaw.

Please see http://seclists.org/oss-sec/2014/q1/174 for CVE REJECT request and further information.

Note You need to log in before you can comment on or make changes to this bug.