Bug 1473649 (CVE-2017-7542) - CVE-2017-7542 kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop
Summary: CVE-2017-7542 kernel: Integer overflow in ip6_find_1stfragopt() causes infini...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-7542
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1473650 1477005 1477006 1477007 1477008 1477009 1477010 1477011 1477012 1477013
Blocks: 1473659
TreeView+ depends on / blocked
 
Reported: 2017-07-21 11:50 UTC by Adam Mariš
Modified: 2021-03-11 15:28 UTC (History)
39 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:17:24 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2017:3163 0 normal SHIPPED_LIVE new packages: kernel-alt 2017-11-09 14:59:25 UTC
Red Hat Product Errata RHSA-2017:2918 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-10-19 17:24:24 UTC
Red Hat Product Errata RHSA-2017:2930 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-10-19 18:47:35 UTC
Red Hat Product Errata RHSA-2017:2931 0 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-10-19 18:48:35 UTC
Red Hat Product Errata RHSA-2018:0169 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2018-01-25 16:22:33 UTC

Description Adam Mariš 2017-07-21 11:50:37 UTC 
Integer overflow vulnerability in ip6_find_1stfragopt() function was found. Local attacker that has privileges to open raw socket can cause infinite loop inside ip6_find_1stfragopt() function.

Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=6399f1fae4ec29fab5ec76070435555e256ca3a6

What is a denial of service:

https://access.redhat.com/denial-of-service-flaw-type
Comment 1 Adam Mariš 2017-07-21 11:51:23 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1473650]
Comment 14 Wade Mealing 2017-09-27 03:43:55 UTC 
Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and does not qualify for inclusion as part of the Red Hat Enterprise Linux 5 lifecycle. For more information on the lifecycle see https://access.redhat.com/support/policy/updates/errata
Comment 16 errata-xmlrpc 2017-10-19 13:26:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2918
Comment 17 errata-xmlrpc 2017-10-19 15:06:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2930
Comment 18 errata-xmlrpc 2017-10-19 15:09:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2017:2931
Comment 20 errata-xmlrpc 2018-01-25 11:31:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:0169 https://access.redhat.com/errata/RHSA-2018:0169
Note You need to log in before you can comment on or make changes to this bug.