Bug 1300237 (CVE-2016-2053) - CVE-2016-2053 kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature()
Summary: CVE-2016-2053 kernel: Kernel panic and system lockup by triggering BUG_ON() i...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-2053
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1250405 1302162 1302163 1303981
Blocks: 1300260
TreeView+ depends on / blocked
 
Reported: 2016-01-20 10:25 UTC by Adam Mariš
Modified: 2021-10-21 00:49 UTC (History)
21 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A syntax vulnerability was discovered in the kernel's ASN1.1 DER decoder, which could lead to memory corruption or a complete local denial of service through x509 certificate DER files. A local system user could use a specially created key file to trigger BUG_ON() in the public_key_verify_signature() function (crypto/asymmetric_keys/public_key.c), to cause a kernel panic and crash the system.
Clone Of:
Environment:
Last Closed: 2021-10-21 00:49:34 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2574 0 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2016-11-03 12:06:10 UTC
Red Hat Product Errata RHSA-2016:2584 0 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2016-11-03 12:08:49 UTC

Description Adam Mariš 2016-01-20 10:25:59 UTC
An issue with ASN1.1 DER decoder was reported that a specially created key file  could lead to a local denial of service (kernel panic) via x509 certificate DER files.

This is caused by triggering a BUG_ON() in public_key_verify_signature() in crypto/asymmetric_keys/public_key.c which causes a kernel panic and system lockup on RHEL kernels.

Vulnerable code:

...
int public_key_verify_signature(const struct public_key *pk,
                                const struct public_key_signature *sig)
{
        const struct public_key_algorithm *algo;

        BUG_ON(!pk);
        BUG_ON(!pk->mpi[0]);
...


Additional references:

http://seclists.org/oss-sec/2016/q1/197

Introduced in commit:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=42d5ec27f873c654a68f7f865dcd7737513e9508

Fixed in commit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0d62e9dd6da45bbf0f33a8617afc5fe774c8f45f

Comment 2 Adam Mariš 2016-01-20 11:27:30 UTC
Acknowledgments:

Name: Philip Pettersson (Samsung)

Comment 3 Wade Mealing 2016-01-22 09:16:38 UTC
Statement:

This issue does not affect the Linux kernels as shipped with Red Hat Enterprise Linux 4, 5 and 6.

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 7, MRG and realtime kernels.

Comment 5 Wade Mealing 2016-01-27 00:46:15 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1302163]

Comment 6 Josh Boyer 2016-01-27 01:15:58 UTC
Is there an upstream discussion on this bug?

Comment 7 David Howells 2016-01-27 14:36:43 UTC
Do we have an appropriately doctored X.509 cert available?

Comment 20 errata-xmlrpc 2016-11-03 15:08:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2574 https://rhn.redhat.com/errata/RHSA-2016-2574.html

Comment 21 errata-xmlrpc 2016-11-03 19:40:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2584 https://rhn.redhat.com/errata/RHSA-2016-2584.html

Comment 22 errata-xmlrpc 2016-11-03 21:31:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2574 https://rhn.redhat.com/errata/RHSA-2016-2574.html

Comment 23 errata-xmlrpc 2016-11-03 21:46:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2584 https://rhn.redhat.com/errata/RHSA-2016-2584.html


Note You need to log in before you can comment on or make changes to this bug.