CVE-2016-8633: Buffer Overflow
A buffer overflow vulnerability due to a lack of input filtering of incoming fragmented datagrams was found in the IP-over-1394 driver [firewire-net] in fragment handling code in the Linux kernel. The vulnerability exists since firewire supported IPv4, i.e. since version 2.6.31 (year 2009) till version v4.9-rc4. A maliciously formed fragment with a respectively large datagramoffset would cause a memcpy past the datagram buffer, which would cause a system panic or possible arbitrary code execution.
The flaw requires [firewire-net] module to be loaded and is remotely exploitable from connected firewire devices, but not over a local network. In general, IP packets enclosed in the firewire frames are completely in spec. In situations when firewire and ipv4 networking is used, the systems are frequently a part of clustering sofware. They would be daisy chained from a single machine with a network connection: GATEWAY <-> HOST1 <-> HOST2 <-> HOST3 <-> HOSTN. So, the gateway could be connected to the internet, and this is how fragmented packets could get to the system. So, while arbitrary code execution is possible, the hardware configuration required for this is special and rare.
Proposed patch:
https://git.kernel.org/cgit/linux/kernel/git/ieee1394/linux1394.git/commit/?h=testing&id=ff89027279ec57d69797cbae7c681672f1dbea71
An upstream patch and merge:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=667121ace9db https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=03daa36f089f
Public message:
http://seclists.org/oss-sec/2016/q4/347
A research on the flaw:
https://eyalitkin.wordpress.com/2016/11/06/cve-publication-cve-2016-8633/
Other sources
drivers/firewire/net.c in the Linux kernel before 4.8.7, in certain unusual hardware configurations, allows remote attackers to execute arbitrary code via crafted fragmented packets.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2016-8633.
What is the severity of CVE-2016-8633?
CVE-2016-8633 has a severity level of high (7).
How does CVE-2016-8633 affect the Linux kernel?
CVE-2016-8633 affects the Linux kernel before version 4.8.7 in certain unusual hardware configurations.
How can remote attackers exploit CVE-2016-8633?
Remote attackers can exploit CVE-2016-8633 by sending crafted fragmented packets.
Where can I find more information about CVE-2016-8633?
You can find more information about CVE-2016-8633 at the following references: [link1](https://git.kernel.org/cgit/linux/kernel/git/ieee1394/linux1394.git/commit/?h=testing&id=ff89027279ec57d69797cbae7c681672f1dbea71), [link2](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=667121ace9db), [link3](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=03daa36f089f).