Bug 1317571 (CVE-2016-0821) - CVE-2016-0821 kernel: Too big poison pointer space
Summary: CVE-2016-0821 kernel: Too big poison pointer space
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-0821
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1317580 1343802
TreeView+ depends on / blocked
 
Reported: 2016-03-14 15:15 UTC by Adam Mariš
Modified: 2021-10-21 00:51 UTC (History)
27 users (show)

Fixed In Version: kernel 4.3
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-21 00:51:04 UTC


Attachments (Terms of Use)

Description Adam Mariš 2016-03-14 15:15:47 UTC
The LIST_POISON feature in include/linux/poison.h in the Linux kernel before 4.3 not properly consider the relationship to the mmap_min_addr value, which makes it easier for attackers to bypass a poison-pointer protection mechanism by triggering the use of an uninitialised list entry.

This is an issue in a security mechanism, not a mechanism for leverage an attack from.  

Upstream patch:

https://github.com/torvalds/linux/commit/8a5e5e02fc83aaf67053ab53b359af08c6c49aaf

Disclosure:
http://www.openwall.com/lists/oss-security/2015/05/02/6

Comment 1 Wade Mealing 2016-04-15 09:09:22 UTC
Statement:

This issue affects versions of the kernel shipped with Red Hat Enterprise
Linux 5, 6, 7 and MRG-2 realtime kernels.

This has been rated as having Moderate security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/ .


Note You need to log in before you can comment on or make changes to this bug.