CVE-2016-8633: Buffer Overflow
First published: Thu Nov 03 2016(Updated: )
A buffer overflow vulnerability due to a lack of input filtering of incoming fragmented datagrams was found in the IP-over-1394 driver [firewire-net] in fragment handling code in the Linux kernel. The vulnerability exists since firewire supported IPv4, i.e. since version 2.6.31 (year 2009) till version v4.9-rc4. A maliciously formed fragment with a respectively large datagram_offset would cause a memcpy past the datagram buffer, which would cause a system panic or possible arbitrary code execution. The flaw requires [firewire-net] module to be loaded and is remotely exploitable from connected firewire devices, but not over a local network. In general, IP packets enclosed in the firewire frames are completely in spec. In situations when firewire and ipv4 networking is used, the systems are frequently a part of clustering sofware. They would be daisy chained from a single machine with a network connection: GATEWAY <-> HOST1 <-> HOST2 <-> HOST3 <-> HOSTN. So, the gateway could be connected to the internet, and this is how fragmented packets could get to the system. So, while arbitrary code execution is possible, the hardware configuration required for this is special and rare. Proposed patch: <a href="https://git.kernel.org/cgit/linux/kernel/git/ieee1394/linux1394.git/commit/?h=testing&id=ff89027279ec57d69797cbae7c681672f1dbea71">https://git.kernel.org/cgit/linux/kernel/git/ieee1394/linux1394.git/commit/?h=testing&id=ff89027279ec57d69797cbae7c681672f1dbea71</a> An upstream patch and merge: <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=667121ace9db">https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=667121ace9db</a> <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=03daa36f089f">https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=03daa36f089f</a> Public message: <a href="http://seclists.org/oss-sec/2016/q4/347">http://seclists.org/oss-sec/2016/q4/347</a> A research on the flaw: <a href="https://eyalitkin.wordpress.com/2016/11/06/cve-publication-cve-2016-8633/">https://eyalitkin.wordpress.com/2016/11/06/cve-publication-cve-2016-8633/</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | <=4.8.6 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.11.10-1 6.12.5-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=667121ace9dbafb368618dbabcf07901c962ddac
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.7
- http://www.openwall.com/lists/oss-security/2016/11/06/1
- http://www.securityfocus.com/bid/94149
- https://access.redhat.com/errata/RHSA-2018:0676
- https://access.redhat.com/errata/RHSA-2018:1062
- https://access.redhat.com/errata/RHSA-2019:1170
- https://access.redhat.com/errata/RHSA-2019:1190
- https://bugzilla.redhat.com/show_bug.cgi?id=1391490
- https://eyalitkin.wordpress.com/2016/11/06/cve-publication-cve-2016-8633/
- https://github.com/torvalds/linux/commit/667121ace9dbafb368618dbabcf07901c962ddac
- https://launchpad.net/bugs/cve/CVE-2016-8633
- https://git.kernel.org/cgit/linux/kernel/git/ieee1394/linux1394.git/commit/?h=testing&id=ff89027279ec57d69797cbae7c681672f1dbea71
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=667121ace9db
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=03daa36f089f
- http://seclists.org/oss-sec/2016/q4/347
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1392294
- https://git.kernel.org/linus/667121ace9dbafb368618dbabcf07901c962ddac
- https://security-tracker.debian.org/tracker/CVE-2016-8633
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8633
- https://nvd.nist.gov/vuln/detail/CVE-2016-8633
- https://ubuntu.com/security/CVE-2016-8633
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-8633.
What is the severity of CVE-2016-8633?
CVE-2016-8633 has a severity level of high (7).
How does CVE-2016-8633 affect the Linux kernel?
CVE-2016-8633 affects the Linux kernel before version 4.8.7 in certain unusual hardware configurations.
How can remote attackers exploit CVE-2016-8633?
Remote attackers can exploit CVE-2016-8633 by sending crafted fragmented packets.
Where can I find more information about CVE-2016-8633?
You can find more information about CVE-2016-8633 at the following references: [link1](https://git.kernel.org/cgit/linux/kernel/git/ieee1394/linux1394.git/commit/?h=testing&id=ff89027279ec57d69797cbae7c681672f1dbea71), [link2](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=667121ace9db), [link3](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=03daa36f089f).
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-8633
- agent/author
- agent/severity
- agent/weakness
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/remedy
- agent/tags
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/4.8.6
- package-manager/debian