Bug 1547824 (CVE-2018-1065) - CVE-2018-1065 kernel: netfilter: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash
Summary: CVE-2018-1065 kernel: netfilter: xtables NULL pointer dereference in ip6_tabl...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1065
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1547827 1547831 1550791
Blocks: 1542365
TreeView+ depends on / blocked
 
Reported: 2018-02-22 03:32 UTC by Sam Fowler
Modified: 2021-02-17 00:47 UTC (History)
43 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the netfilter/iptables subsystem. A user with the netfilter modification capabilities could insert a rule which could panic the system.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:40:49 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2948 0 None None None 2018-10-30 08:58:02 UTC

Description Sam Fowler 2018-02-22 03:32:40 UTC 
The Linux kernel at version 4.15.0-rc9 is vulnerable to a NULL pointer dereference ip6_tables.c:ip6t_do_table() leading to a crash. This vulnerability is only present under certain malformed iptables rulesets.

Inserting malformed rules its a privileged operation as root or a user with CAP_NET_RAW,CAP_NET_ADMIN capabilities ( see man setcap(8) ).

As this requires advanced privileges Red Hat Product Security has rated this flaw as moderate.

Additional References:

Netdev list:
http://lists.openwall.net/netdev/2018/01/27/46

A suggested upstream patch:
http://patchwork.ozlabs.org/patch/870355/

An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=57ebd808a97d7
Comment 3 Sam Fowler 2018-02-22 04:12:55 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1547831]
Comment 10 errata-xmlrpc 2018-10-30 08:57:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:2948 https://access.redhat.com/errata/RHSA-2018:2948
Note You need to log in before you can comment on or make changes to this bug.