Bug 1390832 (CVE-2016-8632) - CVE-2016-8632 kernel: TIPC subsystem: tipc_msg_build() doesn't validate MTU, may cause memory corruption.
Summary: CVE-2016-8632 kernel: TIPC subsystem: tipc_msg_build() doesn't validate MTU, ...
Status: NEW
Alias: CVE-2016-8632
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20161107,repor...
Keywords: Security
Depends On: 1392262
Blocks: 1384811
TreeView+ depends on / blocked
 
Reported: 2016-11-02 03:52 UTC by Wade Mealing
Modified: 2018-01-24 12:32 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible privilege escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. An attacker could create a packet which will overwrite memory outside of allocated space and allow for privilege escalation.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Wade Mealing 2016-11-02 03:52:10 UTC
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation.  The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol.  Not all devices support or allow MTU's below 68 octets.

An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation.

The affected code is not enabled on Red Hat Enterprise Linux 6 and 7.  The affected code was not included in Red Hat Enterprise Linux 5.

Initial patch:
 https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html

Comment 1 Wade Mealing 2016-11-02 03:55:43 UTC
Acknowledgement:

Red Hat would like to thank Qian Zhang from Qihoo 360 Marvel Team for reporting this issue.

Comment 2 Wade Mealing 2016-11-02 05:56:37 UTC
Statement:

This issue is rated as important.  The affected code is not enabled on Red Hat Enterprise Linux 6 and 7 or MRG-2 kernels.  The commit introducing the comment was not included in Red Hat Enterprise Linux 5.

Comment 4 Wade Mealing 2016-11-07 02:57:08 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1392262]

Comment 5 Andrej Nemec 2016-11-08 13:22:47 UTC
References:

http://seclists.org/oss-sec/2016/q4/359


Note You need to log in before you can comment on or make changes to this bug.