A flaw was found in the Linux kernels implementation of sctp protocol in which a remote attacker can trigger an out of bounds read with an offset of up to 64kB. This may panic the machine with a page-fault and the out-of-bounds data does not seem to be returned to the remote attacker.
For this attack to be sucessful, the kernel needs to have both the SCTP protocol module loaded and a process listening as an SCTP server.
Upstream patch:
https://github.com/torvalds/linux/commit/bf911e985d6bbaa328c20c3e05f4eb03de11fdd6
CVE assignment:
http://seclists.org/oss-sec/2016/q4/509
Last updated 24 July 2024
A flaw was found in the CXGB3 kernel driver when the network was considered congested. The kernel would incorrectly misinterpret the congestion as an error condition and incorrectly free/clean up the skb. When the device would then send the skb's queued, these structures would be referenced and may panic the system or allow an attacker to escalate privileges in a use-after-free scenario.
From the patch:
----
The cxgb3send() functions return NETXMIT values, which are positive integers values. So don't treat positive return values as an error. ----
Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3
CVE assignment: http://seclists.org/oss-sec/2016/q1/311
Kernel NULL pointer dereference vulnerability was found in netfilter/nfnatredirect.c in nfnatredirectipv4 function introduced by commit 8b13eddfdf04cbfa561725cfc42d6868fe896f56 ("netfilter: refactor NAT redirect IPv4 to use it from nftables").
Vulnerable code:
unsigned int nfnatredirectipv4(struct skbuff skb, ... { ... rcureadlock(); indev = indevgetrcu(skb->dev); if (indev != NULL) { ifa = indev->ifalist; newdst = ifa->ifalocal; <--- } rcureadunlock(); ... }
'ifa' is not checked before access and can be accessed even if it's NULL. Crash might happen when packets that need to be redirected somehow arrive on an interface which hasn't been yet fully configured.
Patch and crash report:
https://lkml.org/lkml/2015/12/2/618
Oss-security reference:
http://seclists.org/oss-sec/2016/q1/223
CVE assignment:
http://seclists.org/oss-sec/2016/q1/226
drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 does not ensure that certain length values are sufficiently large, which allows remote attackers to cause a denial of service (system crash or large loop) or possibly execute arbitrary code via a crafted packet, related to the (1) ozusbrx and (2) ozusbhandleepdata functions.
Last updated 24 July 2024