A flaw was found on the linux kernel which enables a race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCKZAPPED status, related to net/l2tp/l2tpip.c and net/l2tp/l2tpip6.c.
Upstream patch:
https://github.com/torvalds/linux/commit/32c231164b76
Follow-up upstream patches:
https://github.com/torvalds/linux/commit/0382a25af3c7 https://github.com/torvalds/linux/commit/a3c18422a4b4 https://github.com/torvalds/linux/commit/d5e3a190937a https://github.com/torvalds/linux/commit/df90e6886146 https://github.com/torvalds/linux/commit/31e2f21fb35b
Merge commit of the above series:
https://github.com/torvalds/linux/commit/7752f72748db
Another follow-up upstream patch:
https://github.com/torvalds/linux/commit/94d7ee0baa8b
References:
https://source.android.com/security/bulletin/2017-03-01.html
It was found that the fix for CVE-2016-9576 was incomplete: the Linux kernel's sg implementation did not properly restrict write operations in situations where the KERNELDS option is set. A local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.
A NULL pointer dereference flaw was found in the way the Linux kernel's network subsystem handled socket creation with an invalid protocol identifier. A local user could use this flaw to crash the system.
A vulnerability was found in the Linux kernel. Payloads of NM entries are not supposed to contain NUL. When such entry is processed, only the part prior to the first NUL goes into the concatenation (i.e. the directory entry name being encoded by a bunch of NM entries). The process stops when the amount collected so far + the claimed amount in the current NM entry exceed 254.
However, the value returned as the total length is the sum of claimed sizes, not the actual amount collected. And that can grow pretty large - not unlimited, since you'd need to put CE entries in between to be able to get more than the maximum that could be contained in one isofs directory entry / continuation chunk and the process stops once it had encountered 32 CEs, but you can get about 8Kb easily. And that's what will be passed to readdir callback as the name length. 8Kb copytouser() from a buffer allocated by getfreepage()
References, CVE-ID request and response:
http://seclists.org/oss-sec/2016/q2/363
http://seclists.org/oss-sec/2016/q2/365
Upstream fix:
https://git.kernel.org/linus/99d825822eade8d827a1817357cbf3f889a552d6
A vulnerabilty was found in the Linux kernels hiddev driver. An attacker with permissions to the USB HID device can call an ioctl with the HIDIOCGUSAGES or HIDIOCSUSAGES command, and passes a report id of HIDREPORTIDUNKNOWN range checks that would prevent oversize buffers being copied from userspace to kernel space were bypassed.
The kernel would loop on a a value passed by userspace and can copy memory outside of the intended range. This can corrupt memory located after the struct in memory, duplicating the kernel memory or crashing the system
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93a2001bdfd5376c3dc2158653034c20392d15c5
It was found that the Linux kernel's IPv6 implementation mishandles socket option data. A local attacker can abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.
Upstream patch:
https://github.com/torvalds/linux/commit/45f6fad84cc305103b28d73482b344d7f5b76f39
Kernel panic (via skboverpanic) is encountered when sctp stack receive a malformed asconf chunks.
skboverpanic: text:ffffffffa01ea1c3 len:31056 put:30768 head:ffff88011bd81800 data:ffff88011bd81800 tail:0x7950 end:0x440 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:129! [...] Call Trace: <IRQ> [<ffffffff8144fb1c>] skbput+0x5c/0x70 [<ffffffffa01ea1c3>] sctpaddtochunk+0x63/0xd0 [sctp] [<ffffffffa01eadaf>] sctpprocessasconf+0x1af/0x540 [sctp] [<ffffffff8152d025>] ? readunlockbh+0x15/0x20 [<ffffffffa01e0038>] sctpsfdoasconf+0x168/0x240 [sctp] ...
A remote attacker could use this flaw to crash the system.
Acknowledgements:
This issue was discovered by Liu Wei of Red Hat.
Kernel panic is encountered when sctp stack receives duplicate asconf chunks.
Upstream commmit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b69040d8e39f20d5215a03502a8e8b4c6ab78395
An out-of-bounds memory access flaw was found in the Linux kernel's perf and ftrace subsystems.
On a system with syscall perf profiling on (CVE-2014-7825) an unprivileged local user could use this flaw to crash the system.
On a system with ftrace syscall tracing on (CVE-2014-7826) an unprivileged local user could use this flaw to crash the system or escalate their privileges on the system.
References: http://www.openwall.com/lists/oss-security/2014/11/06/11
Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=086ba77a6db00ed858ff07451bedee197df868c9
Acknowledgements:
Red Hat would like to thank Robert Święcki for reporting these issues.
arch/x86/kernel/entry64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.
An out-of-bounds memory access flaw, CVE-2014-7825, was found in the syscall tracing functionality of the Linux kernel's perf subsystem. A local, unprivileged user could use this flaw to crash the system. Additionally, an out-of-bounds memory access flaw, CVE-2014-7826, was found in the syscall tracing functionality of the Linux kernel's ftrace subsystem. On a system with ftrace syscall tracing enabled, a local, unprivileged user could use this flaw to crash the system, or escalate their privileges.
A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts. A remote attacker could use this flaw to crash the system.
Last updated 24 July 2024
A buffer overflow is present in the method that the kernel uses to handle libceph auth tokens.
A flaw was reported in the Linux kernel where the libceph auth token could cause the kernel to incorrectly handle kmalloc failure.
A flaw was found in the kernels handling of ceph authentication tickets.
The auth reply could be returned to a client unvalidated.
A flaw was found in the way the termination condition in the associative array garbage collection functionality was handled when used from the keys subsystem.
A local unprivileged user could use this flaw to crash the system.
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b2a4df200d570b2c33a57e1ebfa5896e4bc81b69
Array index error in the tcmvhostmaketpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOSTSCSISETENDPOINT ioctl call. NOTE: the affected function was renamed to vhostscsimaketpg before the vulnerability was announced.
Last updated 24 July 2024
A flaw was found in the way the Linux kernel's networking implementation handled UDP packets with incorrect checksum values. A remote attacker could potentially use this flaw to trigger an infinite loop in the kernel, resulting in a denial of service on the system, or cause a denial of service in applications using the edge triggered epoll functionality.
Last updated 24 July 2024
A flaw was discovered in the Linux kernels implementation of VFIO. While issuing an IOCTL, the VFIODEVICESETIRQS parameter for vfio PCI devices has a state machine confusion bug where specifying VFIOIRQSETDATANONE along with another bit in VFIOIRQSETDATATYPEMASK in hdr.flags allows integer overflow checks to be skipped for hdr.start/hdr.count.
This might allow memory corruption later in vfiopcisetmsitrigger() with user access to an appropriate vfio device file, but it seems difficult to usefully exploit in practice.
Proposed patch:
https://patchwork.kernel.org/patch/9373631/
CVE assignment:
http://seclists.org/oss-sec/2016/q4/251
Last updated 24 July 2024
A use after free vulnerability was found in pppunregisterchannel function. This is triggered when network namespace is removed while pppasync channel is still registered in it and pppunregisterchannel() tries to access its per-netns data in the defunct namespace.
An attacker who could control this memory that is being used in the defunct namespace could create a denial of service by spinlocking a CPU.
An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89
CVE request:
http://seclists.org/oss-sec/2016/q2/319
A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module. This action is usually restricted to root-priveledged users but can also be leveraged if the kernel is compiled with CONFIGUSERNS and CONFIGNETNS and the user is granted elevated priveledges.
This flaw was introduced in commit 52e804c6dfaa,
Upstream fixes
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d04 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb088 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bdf533de6968
Discussion on oss-sec: http://www.openwall.com/lists/oss-security/2016/06/24/5
A double free vulnerability was found in netlinkdump, which could cause a denial of service or possibly other unspecified impact.
References:
http://seclists.org/oss-sec/2016/q4/577
http://lists.openwall.net/netdev/2016/05/15/69
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=92964c79b357efd980812c4de5c1fd2ec8bb5520
A flaw was found in the Linux kernel's implementation of setsockopt for the SO{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAPNETADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative. This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
A race condition vulnerability was found in packetsetring that can lead to use after free on a function pointer. This vulnerability can be used to gain kernel code execution for the local attacker capable of creating AFPACKET sockets. This issue was introduced with following commit:
https://github.com/torvalds/linux/commit/f6fb8f100b807378fda19e83e5ac6828b638603a
A use-after-free vulnerability was found in ALSA pcm layer, which allows local users to cause a denial of service, memory corruption or possibly other unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
References:
https://patchwork.kernel.org/patch/8752621/
Upstream patch:
https://github.com/torvalds/linux/commit/3aa02cb664c5fb1042958c8d1aa8c35055a2ebc4
CVE-ID request+assign:
http://seclists.org/oss-sec/2016/q4/575
An issue with ASN.1 DER decoder was reported that could lead to memory corruptions, possible privilege escalation, or complete local denial of service via x509 certificate DER files.
Tags with indefinite length can be used to corrupt the dp and len pointers in asn1findindefinitelength() in lib/asn1decoder.c
Vulnerable code:
... nexttag: if (unlikely(datalen - dp < 2)) { if (datalen == dp) goto missingeoc; goto dataoverrunerror; } ... n = len - 0x80; if (unlikely(n > sizeof(sizet) - 1)) goto lengthtoolong; if (unlikely(n > datalen - dp)) goto dataoverrunerror; for (len = 0; n > 0; n--) { len <<= 8; len |= data[dp++]; } dp += len; goto nexttag; ...
dp can be corrupted and the check at nexttag is not sufficient to prevent this.
Upstream fix: https://lkml.org/lkml/2016/5/12/270
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa