Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1473649 - (CVE-2017-7542) CVE-2017-7542 kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop
CVE-2017-7542 kernel: Integer overflow in ip6_find_1stfragopt() causes infini...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20170719,repor...
: Security
Depends On: 1477013 1473650 1477005 1477006 1477007 1477008 1477009 1477010 1477011 1477012
Blocks: 1473659
  Show dependency treegraph
 
Reported: 2017-07-21 07:50 EDT by Adam Mariš
Modified: 2018-08-28 18:19 EDT (History)
40 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2017:3163 normal SHIPPED_LIVE new packages: kernel-alt 2017-11-09 09:59:25 EST
Red Hat Product Errata RHSA-2017:2918 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-10-19 13:24:24 EDT
Red Hat Product Errata RHSA-2017:2930 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-10-19 14:47:35 EDT
Red Hat Product Errata RHSA-2017:2931 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-10-19 14:48:35 EDT
Red Hat Product Errata RHSA-2018:0169 normal SHIPPED_LIVE Important: kernel security and bug fix update 2018-01-25 11:22:33 EST

  None (edit)
Description Adam Mariš 2017-07-21 07:50:37 EDT
Integer overflow vulnerability in ip6_find_1stfragopt() function was found. Local attacker that has privileges to open raw socket can cause infinite loop inside ip6_find_1stfragopt() function.

Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=6399f1fae4ec29fab5ec76070435555e256ca3a6

What is a denial of service:

https://access.redhat.com/denial-of-service-flaw-type
Comment 1 Adam Mariš 2017-07-21 07:51:23 EDT
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1473650]
Comment 14 Wade Mealing 2017-09-26 23:43:55 EDT
Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and does not qualify for inclusion as part of the Red Hat Enterprise Linux 5 lifecycle. For more information on the lifecycle see https://access.redhat.com/support/policy/updates/errata
Comment 16 errata-xmlrpc 2017-10-19 09:26:36 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2918
Comment 17 errata-xmlrpc 2017-10-19 11:06:24 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2930
Comment 18 errata-xmlrpc 2017-10-19 11:09:53 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2017:2931
Comment 20 errata-xmlrpc 2018-01-25 06:31:40 EST
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:0169 https://access.redhat.com/errata/RHSA-2018:0169

Note You need to log in before you can comment on or make changes to this bug.