CVE-2012-6704: Integer Overflow
A flaw was found in the Linux kernel's implementation of setsockopt for the SO{SND|RCV}BUF setsockopt() system call. Users with non-namespace CAPNETADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
Other sources
A flaw was found in the Linux kernels implementation of setsockopt for the SO{SND|RCV}BUF setsockopt() system call. Users with non-namespace CAPNETADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
This situation affects SOSNDBUFF and SORCVBUFF similarly as shown in CVE-2016-9793.
Upstream patch:
https://github.com/torvalds/linux/commit/82981930125abfd39d7c8378a9cfdf5e1be2002b
CVE assignment:
http://seclists.org/oss-sec/2016/q4/574
— Red Hat
The socksetsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sksndbuf and skrcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAPNETADMIN capability for a crafted setsockopt system call with the (1) SOSNDBUF or (2) SORCVBUF option.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6704?
CVE-2012-6704 has been classified as a high severity vulnerability due to its potential impact on networking functions.
How do I fix CVE-2012-6704?
To fix CVE-2012-6704, upgrade the Linux kernel to version 3.5 or later.
What systems are affected by CVE-2012-6704?
CVE-2012-6704 affects Linux kernel versions prior to 3.5 and between versions 3.3 and 3.5.
Can CVE-2012-6704 be exploited remotely?
CVE-2012-6704 can potentially be exploited by users with non-namespace CAP_NET_ADMIN permissions, impacting socket buffer sizes.
What does CVE-2012-6704 affect in the Linux kernel?
CVE-2012-6704 affects the setsockopt system call, specifically the SO_SND_BUF and SO_RCV_BUF options in the Linux kernel.