Bug 1441088 (CVE-2017-7616) - CVE-2017-7616 kernel: Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c
Summary: CVE-2017-7616 kernel: Incorrect error handling in the set_mempolicy and mbind...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-7616
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1441095 1443539 1443541 1443543 1443545 1443547
Blocks: 1441097
TreeView+ depends on / blocked
 
Reported: 2017-04-11 08:20 UTC by Andrej Nemec
Modified: 2021-02-17 02:21 UTC (History)
31 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Incorrect error handling in the set_mempolicy() and mbind() compat syscalls in 'mm/mempolicy.c' in the Linux kernel allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation.
Clone Of:
Environment:
Last Closed: 2019-06-08 03:10:07 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2017:3163 0 normal SHIPPED_LIVE new packages: kernel-alt 2017-11-09 14:59:25 UTC
Red Hat Product Errata RHSA-2017:1842 0 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2017-08-01 18:22:09 UTC
Red Hat Product Errata RHSA-2017:2077 0 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2017-08-01 18:13:37 UTC
Red Hat Product Errata RHSA-2018:1854 0 None None None 2018-06-19 04:49:33 UTC

Description Andrej Nemec 2017-04-11 08:20:11 UTC 
Incorrect error handling in the set_mempolicy and mbind compat syscalls in mm/mempolicy.c in the Linux kernel allows local users to obtain sensitive information from uninitialized stack data by triggering failure of a certain bitmap operation. 

Advisory:

https://nvd.nist.gov/vuln/detail/CVE-2017-7616

Detailed analysis:

https://grsecurity.net/the_infoleak_that_mostly_wasnt.php

Upstream patch:

https://github.com/torvalds/linux/commit/cf01fb9985e8deb25ccf0ea54d916b8871ae0e62
Comment 1 Andrej Nemec 2017-04-11 08:26:08 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1441095]
Comment 10 Vladis Dronov 2017-04-26 17:33:55 UTC 
Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 on ppc64 and ppc64le platforms. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6 and 7 on ppc64 and ppc64le platforms. Future Linux kernel updates for the respective releases might address this issue.

Only ppc64 and ppc64le hardware platforms are vulnerable. The Linux kernel packages for other platforms which Red Hat ships (i386, x86_64, s390x) are not vulnerable to this security flaw.

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux MRG-2 as this product is shipped for x86_64 hardware platform only.
Comment 11 errata-xmlrpc 2017-08-01 19:15:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2077 https://access.redhat.com/errata/RHSA-2017:2077
Comment 12 errata-xmlrpc 2017-08-02 07:55:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1842 https://access.redhat.com/errata/RHSA-2017:1842
Comment 14 errata-xmlrpc 2018-06-19 04:49:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2018:1854 https://access.redhat.com/errata/RHSA-2018:1854
Note You need to log in before you can comment on or make changes to this bug.