Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1335803 - (CVE-2016-4805) CVE-2016-4805 kernel: Use after free vulnerability in ppp_unregister_channel
CVE-2016-4805 kernel: Use after free vulnerability in ppp_unregister_channel
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20160316,reported=2...
: Security
Depends On: 1335804 1335805
Blocks:
  Show dependency tree / graph
 
Reported: 2016-05-13 05:08 EDT by Adam Mariš
Modified: 2016-06-15 06:21 EDT (History)
38 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A use after free vulnerability was found in ppp_unregister_channel function. This is triggered when network namespace is removed while ppp_async channel is still registered in it and ppp_unregister_channel() tries to access its per-netns data in the defunct namespace. An attacker controlling this data could potentially denial of service the system.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-05-17 23:24:15 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

  None (edit)
Description Adam Mariš 2016-05-13 05:08:05 EDT 
A use after free vulnerability was found in ppp_unregister_channel function. This is triggered when network namespace is removed while ppp_async channel is still registered in it and ppp_unregister_channel() tries to access its per-netns data in the defunct namespace.

An attacker who could control this memory that is being used in the defunct namespace could create a denial of service by spinlocking a CPU.

An unprivileged local user  could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89

CVE request:

http://seclists.org/oss-sec/2016/q2/319
Comment 1 Adam Mariš 2016-05-13 05:08:56 EDT 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1335804]
Comment 3 Wade Mealing 2016-05-17 21:32:02 EDT 
Statement:

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 6, 7 realtime and MRG-2 kernels and does not plan to be addressed in a future update
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.