CVE-2016-3134: Buffer Overflow
In the marksourcechains function (net/ipv4/netfilter/iptables.c) it is possible for a user-supplied iptentry structure to have a large nextoffset field. This field is not bounds checked prior to writing a counter value at the supplied offset.
Proposed fix:
patch v1 message: http://marc.info/?l=netfilter-devel&m=145757134822741&w=2 patch v2 thread: http://marc.info/?t=145757149500006&r=1&w=2
patch v2 message: http://marc.info/?l=netfilter-devel&m=145762719008418&w=2 patch v2 thread: (none yet) http://marc.info/?l=netfilter-devel&r=4&b=201603&w=2
CVE request and assignment:
http://seclists.org/oss-sec/2016/q1/581 http://seclists.org/oss-sec/2016/q1/619
Audit done by netfilter team found several related bugs, patches to better validate rulesets are currently queued in pablos nf-next tree upstream (use "parent" link to cycle to next one - there are 17 additional patches):
https://git.kernel.org/cgit/linux/kernel/git/pablo/nf-next.git/commit/?id=d7591f0c41ce3e67600a982bab6989ef0f07b3ce
Other sources
The netfilter subsystem in the Linux kernel through 4.5.2 does not validate certain offset fields, which allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPTSOSETREPLACE setsockopt call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3134?
CVE-2016-3134 has been classified as a medium severity vulnerability due to potential information leaks and denial of service risks.
How do I fix CVE-2016-3134?
To fix CVE-2016-3134, upgrade your kernel to a version that includes the security patch, such as 5.10.223-1, 5.10.226-1, or later.
Which software is affected by CVE-2016-3134?
CVE-2016-3134 affects various versions of SUSE Linux, including the Enterprise Software Development Kit and Linux Kernel versions up to 4.5.2.
What does CVE-2016-3134 exploit?
CVE-2016-3134 exploits the lack of bounds checking on a user-supplied ipt_entry structure, leading to possible memory corruption.
Is there a workaround for CVE-2016-3134?
There are no known effective workarounds for CVE-2016-3134, and updating to a patched version is the recommended course of action.