Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1445207 - (CVE-2017-7477) CVE-2017-7477 kernel: net: Heap overflow in skb_to_sgvec in macsec.c
CVE-2017-7477 kernel: net: Heap overflow in skb_to_sgvec in macsec.c
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20170424,repo...
: Security
Depends On: 1445208 1445545 1445546 1445547 1445548 1445549
Blocks: 1445173
  Show dependency treegraph
 
Reported: 2017-04-25 05:10 EDT by Andrej Nemec
Modified: 2017-09-05 01:07 EDT (History)
40 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way Linux kernel allocates heap memory to build the scattergather list from a fragment list(skb_shinfo(skb)->frag_list) in the socket buffer(skb_buff). The heap overflow occurred if 'MAX_SKB_FRAGS + 1' parameter and 'NETIF_F_FRAGLIST' feature are both used together. A remote user or process could use this flaw to potentially escalate their privilege on a system.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-09-05 01:07:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1615 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-06-29 12:41:56 EDT
Red Hat Product Errata RHSA-2017:1616 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-06-28 16:57:58 EDT

  None (edit)
Description Andrej Nemec 2017-04-25 05:10:38 EDT
A heap overflow vulnerability was found in the Linux kernel in macsec module. Specifying MAX_SKB_FRAGS + 1 and using NETIF_F_FRAGLIST which calls skb_to_sgvec will overflow the heap.

Upstream patches:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b
Comment 1 Andrej Nemec 2017-04-25 05:11:27 EDT
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1445208]
Comment 2 Andrej Nemec 2017-04-25 05:38:00 EDT
References:

http://seclists.org/oss-sec/2017/q2/119
Comment 3 Jason A. Donenfeld 2017-04-25 08:37:30 EDT
I found this vulnerability and reported it prior to oss-sec. The original email to oss-sec is here:

http://www.openwall.com/lists/oss-security/2017/04/24/4

The LKML discussion took place here:

https://lkml.org/lkml/2017/4/21/689
Comment 4 Petr Matousek 2017-04-25 10:02:41 EDT
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 starting with the version kernel-3.10.0-514.el7, that is with Red Hat Enterprise Linux 7.3 GA. Prior Red Hat Enterprise Linux 7 kernel versions are not affected.

In order to exploit this issue, the system needs to be manually configured by privileged user. The default Red Hat Enterprise Linux 7 configuration is not vulnerable.
Comment 7 Jason A. Donenfeld 2017-04-26 16:28:49 EDT
A subsequent upstream patch is here:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b

This *must* be applied to receive protection.
Comment 8 Wade Mealing 2017-04-26 20:36:08 EDT
Mitigation:

Red Hat recommends blacklisting the kernel module to prevent its use. This will prevent accidental version loading by administration and also mitigate the flaw if a kernel with the affected module is booted.

As the macsec module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions:
Raw

  # echo "install macsec /bin/true" >> /etc/modprobe.d/disable-macsec.conf 

If macsec functionality is in use as a functional part of the system a kernel upgrade is required.
Comment 9 errata-xmlrpc 2017-06-28 13:05:26 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1615 https://access.redhat.com/errata/RHSA-2017:1615
Comment 10 errata-xmlrpc 2017-06-28 13:08:46 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1616 https://access.redhat.com/errata/RHSA-2017:1616

Note You need to log in before you can comment on or make changes to this bug.