A flaw was found in the CXGB3 kernel driver when the network was considered congested. The kernel would incorrectly misinterpret the congestion as an error condition and incorrectly free/clean up the skb. When the device would then send the skb's queued, these structures would be referenced and may panic the system or allow an attacker to escalate privileges in a use-after-free scenario.

From the patch:

----

The cxgb3send() functions return NETXMIT values, which are positive integers values. So don't treat positive return values as an error. ----

Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3

CVE assignment: http://seclists.org/oss-sec/2016/q1/311

Last updated 29 November 2024

An use after free flaw was found in the Linux kernel SCTP implementation handled auth keys reference counting during INIT collisions.

A remote user could use this flaw to crash the system or, though unlikely, escalate their privileges on the system.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=600ddd6825543962fb807884169e57b580dba208

Acknowledgements:

This issue was discovered by Sun Baoliang of Red Hat.

A flaw was found in the Linux kernels implementation of sctp protocol in which a remote attacker can trigger an out of bounds read with an offset of up to 64kB. This may panic the machine with a page-fault and the out-of-bounds data does not seem to be returned to the remote attacker.

For this attack to be sucessful, the kernel needs to have both the SCTP protocol module loaded and a process listening as an SCTP server.

Upstream patch:

https://github.com/torvalds/linux/commit/bf911e985d6bbaa328c20c3e05f4eb03de11fdd6

CVE assignment:

http://seclists.org/oss-sec/2016/q4/509

Last updated 24 July 2024

Last updated 24 July 2024