Bug 1445207 (CVE-2017-7477) - CVE-2017-7477 kernel: net: Heap overflow in skb_to_sgvec in macsec.c
Summary: CVE-2017-7477 kernel: net: Heap overflow in skb_to_sgvec in macsec.c
Status: CLOSED ERRATA
Alias: CVE-2017-7477
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20170424,repo...
Keywords: Security
Depends On: 1445208 1445545 1445546 1445547 1445548 1445549
Blocks: 1445173
TreeView+ depends on / blocked
 
Reported: 2017-04-25 09:10 UTC by Andrej Nemec
Modified: 2017-09-05 05:07 UTC (History)
40 users (show)

(edit)
A flaw was found in the way Linux kernel allocates heap memory to build the scattergather list from a fragment list(skb_shinfo(skb)->frag_list) in the socket buffer(skb_buff). The heap overflow occurred if 'MAX_SKB_FRAGS + 1' parameter and 'NETIF_F_FRAGLIST' feature are both used together. A remote user or process could use this flaw to potentially escalate their privilege on a system.
Clone Of:
(edit)
Last Closed: 2017-09-05 05:07:46 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:1615 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-06-29 16:41:56 UTC
Red Hat Product Errata RHSA-2017:1616 normal SHIPPED_LIVE Important: kernel-rt security and bug fix update 2017-06-28 20:57:58 UTC

Description Andrej Nemec 2017-04-25 09:10:38 UTC
A heap overflow vulnerability was found in the Linux kernel in macsec module. Specifying MAX_SKB_FRAGS + 1 and using NETIF_F_FRAGLIST which calls skb_to_sgvec will overflow the heap.

Upstream patches:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d6fa57b4dab0d77f4d8e9d9c73d1e63f6fe8fee
https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b

Comment 1 Andrej Nemec 2017-04-25 09:11:27 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1445208]

Comment 2 Andrej Nemec 2017-04-25 09:38:00 UTC
References:

http://seclists.org/oss-sec/2017/q2/119

Comment 3 Jason A. Donenfeld 2017-04-25 12:37:30 UTC
I found this vulnerability and reported it prior to oss-sec. The original email to oss-sec is here:

http://www.openwall.com/lists/oss-security/2017/04/24/4

The LKML discussion took place here:

https://lkml.org/lkml/2017/4/21/689

Comment 4 Petr Matousek 2017-04-25 14:02:41 UTC
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG 2.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 starting with the version kernel-3.10.0-514.el7, that is with Red Hat Enterprise Linux 7.3 GA. Prior Red Hat Enterprise Linux 7 kernel versions are not affected.

In order to exploit this issue, the system needs to be manually configured by privileged user. The default Red Hat Enterprise Linux 7 configuration is not vulnerable.

Comment 7 Jason A. Donenfeld 2017-04-26 20:28:49 UTC
A subsequent upstream patch is here:

https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b

This *must* be applied to receive protection.

Comment 8 Wade Mealing 2017-04-27 00:36:08 UTC
Mitigation:

Red Hat recommends blacklisting the kernel module to prevent its use. This will prevent accidental version loading by administration and also mitigate the flaw if a kernel with the affected module is booted.

As the macsec module will be auto-loaded when required, its use can be disabled by preventing the module from loading with the following instructions:
Raw

  # echo "install macsec /bin/true" >> /etc/modprobe.d/disable-macsec.conf 

If macsec functionality is in use as a functional part of the system a kernel upgrade is required.

Comment 9 errata-xmlrpc 2017-06-28 17:05:26 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1615 https://access.redhat.com/errata/RHSA-2017:1615

Comment 10 errata-xmlrpc 2017-06-28 17:08:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1616 https://access.redhat.com/errata/RHSA-2017:1616


Note You need to log in before you can comment on or make changes to this bug.