Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1373966 - (CVE-2016-7042) CVE-2016-7042 kernel: Stack corruption while reading /proc/keys when gcc stack protector is enabled
CVE-2016-7042 kernel: Stack corruption while reading /proc/keys when gcc stac...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20161013,repor...
: Security
Depends On: 1375211 1373499 1375208 1375209 1375210 1375212
Blocks: 1373967
  Show dependency tree / graph
 
Reported: 2016-09-07 10:48 EDT by Adam Mariš
Modified: 2018-08-28 18:08 EDT (History)
21 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was found that when the gcc stack protector was enabled, reading the /proc/keys file could cause a panic in the Linux kernel due to stack corruption. This happened because an incorrect buffer size was used to hold a 64-bit timeout value rendered as weeks.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Fix for buffer overflow in proc_keys_show (2.63 KB, patch)
2016-09-12 09:42 EDT, Vladis Dronov 		no flags Details | Diff
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0817 normal SHIPPED_LIVE Moderate: kernel security, bug fix, and enhancement update 2017-03-21 09:06:51 EDT
Red Hat Product Errata RHSA-2017:1842 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2017-08-01 14:22:09 EDT
Red Hat Product Errata RHSA-2017:2077 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2017-08-01 14:13:37 EDT
Red Hat Product Errata RHSA-2017:2669 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-09-06 20:36:52 EDT

  None (edit)
Description Adam Mariš 2016-09-07 10:48:59 EDT 
It was found that when gcc stack protector is turned on, proc_keys_show() can cause a panic due to stack corruption. This happens because xbuf[] is not big enough to hold a 64-bit timeout rendered as weeks.

Product bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1373499
Comment 1 Adam Mariš 2016-09-07 10:49:03 EDT 
Acknowledgments:

Name: Ondrej Kozina (Red Hat)
Comment 7 Vladis Dronov 2016-09-12 09:40:18 EDT 
Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG-2. Future Linux kernel updates for the respective releases might address this issue.
Comment 8 Vladis Dronov 2016-09-12 09:42 EDT 
Created attachment 1200212 [details]
Fix for buffer overflow in proc_keys_show
Comment 9 Vladis Dronov 2016-10-13 08:31:14 EDT 
cve-id CVE-2016-7042 was assigned to this flaw internally by the Red Hat. please, use it in the public communications regarding this flaw.
Comment 11 errata-xmlrpc 2017-03-21 09:14:56 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0817 https://rhn.redhat.com/errata/RHSA-2017-0817.html
Comment 12 errata-xmlrpc 2017-08-01 15:09:29 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2077
Comment 13 errata-xmlrpc 2017-08-02 03:48:19 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:1842
Comment 14 errata-xmlrpc 2017-09-06 16:38:04 EDT 
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2017:2669 https://access.redhat.com/errata/RHSA-2017:2669
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.