Bug 186295 - CVE-2006-0038 netfilters do_replace() overflow
CVE-2006-0038 netfilters do_replace() overflow
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel (Show other bugs)
All Linux
medium Severity low
: ---
: ---
Assigned To: Thomas Graf
Brian Brock
: Security
Depends On:
Blocks: 181409
  Show dependency treegraph
Reported: 2006-03-22 14:11 EST by Marcel Holtmann
Modified: 2014-06-18 04:28 EDT (History)
4 users (show)

See Also:
Fixed In Version: RHSA-2006-0575
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-08-10 18:53:53 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Marcel Holtmann 2006-03-22 14:11:45 EST
netfilter's do_replace() can overflow on addition within SMP_ALIGN() and/or on
multiplication by NR_CPUS, resulting in a buffer overflow on the
copy_from_user(). In practice, the overflow on addition is triggerable on all
systems, whereas the multiplication one might require much physical memory to be
present due to the check above. Either is sufficient to overwrite arbitrary
amounts of kernel memory.

Found by Solar Designer during security audit of OpenVZ.org

On http://www.securityfocus.com/bid/17178/info this is marked as a remote buffer
overflow. This is wrong. You need CAP_NET_ADMIN rights and Solar Designer writes:

The SecurityFocus vuldb entry is wrong. The vulnerability is not remotely
exploitable. It is local only and the bug is only security relevant on systems
which use certain virtualization solutions such as OpenVZ (with certain settings
allowing VPS root to configure iptables) and presumably linux-vserver (although
I did not check the latter).

It is not security relevant on stock kernels or on most of the distribution
vendors' kernels.

This bug has been fixed in the 2.6.16 mainline kernel (actually 2.6.16-rc3 to be
more precise):

Comment 6 Jason Baron 2006-04-06 21:55:32 EDT
committed in stream U4 build 34.14. A test kernel with this patch is available
from http://people.redhat.com/~jbaron/rhel4/
Comment 7 Bob Johnson 2006-04-11 12:55:53 EDT
This issue is on Red Hat Engineering's list of planned work items 
for the upcoming Red Hat Enterprise Linux 4.4 release.  Engineering 
resources have been assigned and barring unforeseen circumstances, Red 
Hat intends to include this item in the 4.4 release.
Comment 10 Mike Gahagan 2006-07-14 17:22:23 EDT
Fix is in -42, setting to verified.
Comment 12 Red Hat Bugzilla 2006-08-10 18:54:00 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.