Bug 1030800 (CVE-2013-4588) - CVE-2013-4588 Kernel: net: ipvs: stack buffer overflow
Summary: CVE-2013-4588 Kernel: net: ipvs: stack buffer overflow
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2013-4588
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1030815 1030816 1030817 1030818 1052135
Blocks: 1029049
TreeView+ depends on / blocked
 
Reported: 2013-11-15 07:27 UTC by Prasad Pandit
Modified: 2021-02-17 07:11 UTC (History)
33 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-02-05 12:07:14 UTC
Embargoed:

Attachments (Terms of Use)

Description Prasad Pandit 2013-11-15 07:27:57 UTC 
Linux kernel built with the IP Virtual Server(CONFIG_IP_VS) support is
vulnerable to a buffer overflow flaw. It could occur while setting or
retrieving socket options via setsockopt(2) or getsockopt(2) calls.
Though a user needs to have CAP_NET_ADMIN privileges to perform these IP_VS
operations.

A user/program with CAP_NET_ADMIN privileges could use this flaw to further escalate their privileges on a system.

Upstream fix:
-------------
 -> https://git.kernel.org/linus/04bcef2a83f40c6db24222b27a52892cba39dffb


UPDATE:
=======
The bounds check(below) added by the above patch are found to be redundant. The same are present in routine 'nf_sockopt_find'. [1]

  + if (cmd < IP_VS_BASE_CTL || cmd > IP_VS_SO_SET_MAX)
  +     return -EINVAL;
  + if (len < 0 || len > MAX_ARG_LEN)
  +     return -EINVAL;

[1] https://lkml.org/lkml/2009/9/30/265

That makes it a security non-issue.

Please see: -> http://seclists.org/oss-sec/2014/q1/174
Comment 1 Prasad Pandit 2013-11-15 07:35:05 UTC 
Statement:

The Red Hat Security Response Team does not consider this issue to be a security flaw.

Please see http://seclists.org/oss-sec/2014/q1/174 for CVE REJECT request and further information.
Note You need to log in before you can comment on or make changes to this bug.