Fedora Account System
Red Hat Associate
Red Hat Customer
It was reported that due to buffer overflow, it is possible for remote TCP endpoint to trigger the opposite TCP endpoint to write to a socket in sequence which causes the ethernet driver to send arbitrary kernel data over the ethernet interface instead of a portion of the intended packet data. Initially this issue was believed to be present in a number of mainline drivers in 3.10.x and 4.4.2 vanilla kernel sources. After further investigation it was found that only [atl2] driver (code in drivers/net/ethernet/atheros/atlx/atl2.c) from the list of suspected drivers is vulnerable. As a result, certain conditions should be met to trigger the issue: - the [atl2] driver and the corresponding network card (which believed to be not so frequently used) should be present on the target system - an application should make such a sequence of calls that a network buffer for the data to be transmitted is scattered - hardware checksumming should be enabled so the packet checksum is correct The above makes this vulnerability less probable to be hit.
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1318336]
Public via: http://seclists.org/oss-sec/2016/q1/658
Acknowledgments: Name: Justin Yackoski (Cryptonite)
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 as the code with the flaw is not present in the products listed. This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 6 as the suspected driver does not advertise that it has scatter-gather feature, which presence is essential for the flaw. This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2, namely the [atl2] Ethernet driver which is the only driver affected. Future Linux kernel updates for the respective releases might address this issue.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:2574 https://rhn.redhat.com/errata/RHSA-2016-2574.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:2584 https://rhn.redhat.com/errata/RHSA-2016-2584.html