Bug 459226 (CVE-2008-3276) - CVE-2008-3276 Linux kernel dccp_setsockopt_change() integer overflow
Summary: CVE-2008-3276 Linux kernel dccp_setsockopt_change() integer overflow
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2008-3276
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 459231 459232 459235
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-08-15 07:35 UTC by Eugene Teo (Security Response)
Modified: 2019-09-29 12:26 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-12-23 21:48:29 UTC


Attachments (Terms of Use)
Upstream patch for this issue (1.01 KB, patch)
2008-08-15 07:47 UTC, Eugene Teo (Security Response)
no flags Details | Diff
Proposed backported patch for MRG kernel (750 bytes, patch)
2008-08-20 04:07 UTC, Eugene Teo (Security Response)
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0857 normal SHIPPED_LIVE Important: kernel security and bug fix update 2008-10-07 19:18:59 UTC
Red Hat Product Errata RHSA-2008:0957 normal SHIPPED_LIVE Important: kernel security and bug fix update 2008-11-12 09:34:44 UTC

Description Eugene Teo (Security Response) 2008-08-15 07:35:02 UTC
Description of problem:
Eugene Teo reported that an integer overflow flaw was found in the Linux kernel dccp_setsockopt_change() function. The vulnerability exists due to a lack of sanitisation performed on a user-controlled integer value before the value is employed as the size argument of a memory allocation operation. An attacker may leverage this vulnerability to trigger a kernel panic on a victim's machine remotely.

Comment 2 Eugene Teo (Security Response) 2008-08-15 07:47:00 UTC
Created attachment 314378 [details]
Upstream patch for this issue

Comment 7 Eugene Teo (Security Response) 2008-08-20 04:07:07 UTC
Created attachment 314606 [details]
Proposed backported patch for MRG kernel

Comment 9 Eugene Teo (Security Response) 2008-08-20 05:50:27 UTC
On Red Hat Enterprise Linux 5, SELinux denies access requested by default:

type=AVC msg=audit(1217928226.398:41): avc:  denied  { create } for pid=4974 comm="server" scontext=user_u:system_r:unconfined_t:s0 tcontext=user_u:system_r:unconfined_t:s0 tclass=dccp_socket type=SYSCALL msg=audit(1217928226.398:41): arch=c000003e syscall=41 success=no exit=-13 a0=2 a1=6 a2=21 a3=0 items=0 ppid=3599 pid=4974 auid=500 uid=500 gid=500 euid=500 suid=500 fsuid=500 egid=500 sgid=500 fsgid=500 tty=pts0 ses=1 comm="server" exe="/home/test/dccp-CVE-2008-3276/server" subj=user_u:system_r:unconfined_t:s0 key=(null)

socket(PF_INET, 0x6 /* SOCK_??? */, 0x21 /* IPPROTO_??? */) = -1 EACCES (Permission denied)

Comment 10 Luis Claudio R. Goncalves 2008-08-21 18:20:52 UTC
Patch queued for -78

Comment 11 David Sommerseth 2008-09-30 16:56:58 UTC
Verified.  Found both proposed and backported patch as mrg-rt.git commit 3e1ad8433fc1b6ca4eafd4b8b349ea88ef135fd2.

Disabled SELinux and run reproducer on 2.6.24.7-74rt and 2.6.24.7-81rt kernels.  Kernel crashed on -74rt and gave "setsockopt: Invalid argument" as error on -81rt.

Comment 15 Vincent Danen 2010-12-23 21:48:29 UTC
This was addressed via:

MRG Realtime for RHEL 5 Server (RHSA-2008:0857)
Red Hat Enterprise Linux version 5 (RHSA-2008:0957)


Note You need to log in before you can comment on or make changes to this bug.