Bug 1040010 – CVE-2013-7027 Kernel: wireless: radiotap: parsing buffer overrun

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1040010 - (CVE-2013-7027) CVE-2013-7027 Kernel: wireless: radiotap: parsing buffer overrun

Summary:	CVE-2013-7027 Kernel: wireless: radiotap: parsing buffer overrun

Status:	CLOSED NOTABUG

Aliases:	CVE-2013-7027

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20131011,repor...
Keywords:	Security

Depends On:
Blocks:	1039883
	Show dependency tree / graph

Reported:	2013-12-10 08:49 EST by Prasad J Pandit
Modified:	2014-06-17 05:26 EDT (History)
CC List:	8 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-06-17 05:26:19 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Prasad J Pandit 2013-12-10 08:49:46 EST

Linux kernel built with the cfg80211 - wireless configuration API
support(CONFIG_CFG80211) is vulnerable to a potential DoS caused by buffer
over-read while parsing wireless packet header.

Upstream fix:
-------------
 -> https://git.kernel.org/linus/f5563318ff1bde15b10e736e97ffce13be08bc1a

Comment 1 Prasad J Pandit 2013-12-31 01:31:25 EST

Red Hat does not consider this to be a security flaw. The issue is an OOB read of 4 bytes beyond the "radiotap" header. Though this value is out of header bounds, it is well within the network socket buffer(sk_buff) object. It is not an OOB read which would result in a system crash(DoS) due to invalid read access.

Statement:

The Red Hat Security Response Team does not consider this issue to be a security flaw. For more details please refer to https://bugzilla.redhat.com/show_bug.cgi?id=1040010#c1

Note You need to log in before you can comment on or make changes to this bug.