Bug 1390832 (CVE-2016-8632) - CVE-2016-8632 kernel: TIPC subsystem: tipc_msg_build() doesn't validate MTU, may cause memory corruption.
Summary: CVE-2016-8632 kernel: TIPC subsystem: tipc_msg_build() doesn't validate MTU, ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2016-8632
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1392262
Blocks: Embargoed1384811
TreeView+ depends on / blocked
 
Reported: 2016-11-02 03:52 UTC by Wade Mealing
Modified: 2023-05-12 14:47 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible privilege escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. An attacker could create a packet which will overwrite memory outside of allocated space and allow for privilege escalation.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:01:46 UTC

Attachments (Terms of Use)

Description Wade Mealing 2016-11-02 03:52:10 UTC 
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation.  The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol.  Not all devices support or allow MTU's below 68 octets.

An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation.

The affected code is not enabled on Red Hat Enterprise Linux 6 and 7.  The affected code was not included in Red Hat Enterprise Linux 5.

Initial patch:
 https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html
Comment 1 Wade Mealing 2016-11-02 03:55:43 UTC 
Acknowledgement:

Red Hat would like to thank Qian Zhang from Qihoo 360 Marvel Team for reporting this issue.
Comment 2 Wade Mealing 2016-11-02 05:56:37 UTC 
Statement:

This issue is rated as important.  The affected code is not enabled on Red Hat Enterprise Linux 6 and 7 or MRG-2 kernels.  The commit introducing the comment was not included in Red Hat Enterprise Linux 5.
Comment 4 Wade Mealing 2016-11-07 02:57:08 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1392262]
Comment 5 Andrej Nemec 2016-11-08 13:22:47 UTC 
References:

http://seclists.org/oss-sec/2016/q4/359
Note You need to log in before you can comment on or make changes to this bug.