Bug 1300237 - (CVE-2016-2053) CVE-2016-2053 kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature()
CVE-2016-2053 kernel: Kernel panic and system lockup by triggering BUG_ON() i...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20160125,repor...
: Security
Depends On: 1250405 1302162 1302163 1303981
Blocks: 1300260
  Show dependency treegraph
 
Reported: 2016-01-20 05:25 EST by Adam Mariš
Modified: 2017-03-01 15:38 EST (History)
27 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A syntax vulnerability was discovered in the kernel's ASN1.1 DER decoder, which could lead to memory corruption or a complete local denial of service through x509 certificate DER files. A local system user could use a specially created key file to trigger BUG_ON() in the public_key_verify_signature() function (crypto/asymmetric_keys/public_key.c), to cause a kernel panic and crash the system.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2016-01-20 05:25:59 EST
An issue with ASN1.1 DER decoder was reported that a specially created key file  could lead to a local denial of service (kernel panic) via x509 certificate DER files.

This is caused by triggering a BUG_ON() in public_key_verify_signature() in crypto/asymmetric_keys/public_key.c which causes a kernel panic and system lockup on RHEL kernels.

Vulnerable code:

...
int public_key_verify_signature(const struct public_key *pk,
                                const struct public_key_signature *sig)
{
        const struct public_key_algorithm *algo;

        BUG_ON(!pk);
        BUG_ON(!pk->mpi[0]);
...


Additional references:

http://seclists.org/oss-sec/2016/q1/197

Introduced in commit:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=42d5ec27f873c654a68f7f865dcd7737513e9508

Fixed in commit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0d62e9dd6da45bbf0f33a8617afc5fe774c8f45f
Comment 2 Adam Mariš 2016-01-20 06:27:30 EST
Acknowledgments:

Name: Philip Pettersson (Samsung)
Comment 3 Wade Mealing 2016-01-22 04:16:38 EST
Statement:

This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 4, 5 and 6.

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7, MRG and realtime kernels.
Comment 5 Wade Mealing 2016-01-26 19:46:15 EST
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1302163]
Comment 6 Josh Boyer 2016-01-26 20:15:58 EST
Is there an upstream discussion on this bug?
Comment 7 David Howells 2016-01-27 09:36:43 EST
Do we have an appropriately doctored X.509 cert available?
Comment 20 errata-xmlrpc 2016-11-03 11:08:39 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2574 https://rhn.redhat.com/errata/RHSA-2016-2574.html
Comment 21 errata-xmlrpc 2016-11-03 15:40:24 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2584 https://rhn.redhat.com/errata/RHSA-2016-2584.html
Comment 22 errata-xmlrpc 2016-11-03 17:31:27 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2574 https://rhn.redhat.com/errata/RHSA-2016-2574.html
Comment 23 errata-xmlrpc 2016-11-03 17:46:56 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2584 https://rhn.redhat.com/errata/RHSA-2016-2584.html

Note You need to log in before you can comment on or make changes to this bug.