Bug 1473649 (CVE-2017-7542) - CVE-2017-7542 kernel: Integer overflow in ip6_find_1stfragopt() causes infinite loop
Summary: CVE-2017-7542 kernel: Integer overflow in ip6_find_1stfragopt() causes infini...
Status: NEW
Alias: CVE-2017-7542
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
(Show other bugs)
Version: unspecified
Hardware: All Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20170719,repor...
Keywords: Security
Depends On: 1477013 1473650 1477005 1477006 1477007 1477008 1477009 1477010 1477011 1477012
Blocks: 1473659
TreeView+ depends on / blocked
 
Reported: 2017-07-21 11:50 UTC by Adam Mariš
Modified: 2018-08-28 22:19 UTC (History)
40 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An integer overflow vulnerability in ip6_find_1stfragopt() function was found. A local attacker that has privileges (of CAP_NET_RAW) to open raw socket can cause an infinite loop inside the ip6_find_1stfragopt() function.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2017:3163 normal SHIPPED_LIVE new packages: kernel-alt 2017-11-09 14:59:25 UTC
Red Hat Product Errata RHSA-2017:2918 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-10-19 17:24:24 UTC
Red Hat Product Errata RHSA-2017:2930 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-10-19 18:47:35 UTC
Red Hat Product Errata RHSA-2017:2931 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-10-19 18:48:35 UTC
Red Hat Product Errata RHSA-2018:0169 normal SHIPPED_LIVE Important: kernel security and bug fix update 2018-01-25 16:22:33 UTC

Description Adam Mariš 2017-07-21 11:50:37 UTC
Integer overflow vulnerability in ip6_find_1stfragopt() function was found. Local attacker that has privileges to open raw socket can cause infinite loop inside ip6_find_1stfragopt() function.

Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=6399f1fae4ec29fab5ec76070435555e256ca3a6

What is a denial of service:

https://access.redhat.com/denial-of-service-flaw-type

Comment 1 Adam Mariš 2017-07-21 11:51:23 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1473650]

Comment 14 Wade Mealing 2017-09-27 03:43:55 UTC
Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and does not qualify for inclusion as part of the Red Hat Enterprise Linux 5 lifecycle. For more information on the lifecycle see https://access.redhat.com/support/policy/updates/errata

Comment 16 errata-xmlrpc 2017-10-19 13:26:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2918

Comment 17 errata-xmlrpc 2017-10-19 15:06:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2930

Comment 18 errata-xmlrpc 2017-10-19 15:09:53 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2017:2931

Comment 20 errata-xmlrpc 2018-01-25 11:31:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:0169 https://access.redhat.com/errata/RHSA-2018:0169


Note You need to log in before you can comment on or make changes to this bug.