Bug 1349886 (CVE-2016-4998) - CVE-2016-4998 kernel: out of bounds reads when processing IPT_SO_SET_REPLACE setsockopt
Summary: CVE-2016-4998 kernel: out of bounds reads when processing IPT_SO_SET_REPLACE ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-4998
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1318693 1318695 1350316 1351421 1351422 1351423 1351424 1351425 1351426 1351427 1351428 1364809 1364810
Blocks: 1349725
TreeView+ depends on / blocked
 
Reported: 2016-06-24 12:51 UTC by Adam Mariš
Modified: 2021-02-17 03:39 UTC (History)
29 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds heap memory access leading to a Denial of Service, heap disclosure, or further impact was found in setsockopt(). The function call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw in privileged container environments.
Clone Of:
Environment:
Last Closed: 2017-01-19 12:37:52 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:1847 0 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2016-09-15 11:38:04 UTC
Red Hat Product Errata RHSA-2016:1875 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2016-09-15 11:39:21 UTC
Red Hat Product Errata RHSA-2016:1883 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2016-09-15 03:41:02 UTC
Red Hat Product Errata RHSA-2017:0036 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-01-10 22:03:19 UTC

Description Adam Mariš 2016-06-24 12:51:05 UTC 
An out-of-bounds heap memory access, leading to a Denial of Service or possibly heap disclosure or further impact was found in setsockopt(). The particular setsockopt() call is normally restricted to root, however some processes with cap_sys_admin may also be able to trigger this flaw.

Upstream fixes

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d04
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb088
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bdf533de6968

Discussion on oss-sec:
http://www.openwall.com/lists/oss-security/2016/06/24/5
Comment 2 Andrej Nemec 2016-06-27 06:38:44 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1350316]
Comment 3 Andrej Nemec 2016-06-27 06:39:05 UTC 
Public via:

http://seclists.org/oss-sec/2016/q2/599
Comment 11 Fedora Update System 2016-06-30 21:24:18 UTC 
kernel-4.6.3-300.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2016-07-02 19:24:38 UTC 
kernel-4.5.7-202.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 13 Fedora Update System 2016-07-19 07:19:30 UTC 
kernel-4.4.14-200.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 14 errata-xmlrpc 2016-09-14 23:43:59 UTC 
This issue has been addressed in the following products:

  MRG for RHEL-6 v.2

Via RHSA-2016:1883 https://rhn.redhat.com/errata/RHSA-2016-1883.html
Comment 15 errata-xmlrpc 2016-09-15 08:02:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:1847 https://rhn.redhat.com/errata/RHSA-2016-1847.html
Comment 16 errata-xmlrpc 2016-09-15 08:11:33 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:1875 https://rhn.redhat.com/errata/RHSA-2016-1875.html
Comment 19 errata-xmlrpc 2017-01-10 17:08:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0036 https://rhn.redhat.com/errata/RHSA-2017-0036.html
Note You need to log in before you can comment on or make changes to this bug.