Last updated 29 November 2024
An attacker within bluetooth transmission range can cause a stack buffer overflow in the Bluetooth system of the Linux kernel while processing pending L2CAP configuration responses from a client. An unauthenticated user able to connect to a system via Bluetooth could use this flaw to potentially execute arbitrary code with root privileges on the system.
External References:
https://www.armis.com/blueborne/ https://access.redhat.com/security/vulnerabilities/blueborne https://access.redhat.com/solutions/3177231 https://access.redhat.com/blogs/product-security/posts/blueborne
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
Last updated 29 November 2024
It was found that the fix for CVE-2016-9576 was incomplete: the Linux kernel's sg implementation did not properly restrict write operations in situations where the KERNELDS option is set. A local attacker to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging write access to a /dev/sg device.
A NULL pointer dereference flaw was found in the way the Linux kernel's network subsystem handled socket creation with an invalid protocol identifier. A local user could use this flaw to crash the system.
A vulnerability was found in the Linux kernel. Payloads of NM entries are not supposed to contain NUL. When such entry is processed, only the part prior to the first NUL goes into the concatenation (i.e. the directory entry name being encoded by a bunch of NM entries). The process stops when the amount collected so far + the claimed amount in the current NM entry exceed 254.
However, the value returned as the total length is the sum of claimed sizes, not the actual amount collected. And that can grow pretty large - not unlimited, since you'd need to put CE entries in between to be able to get more than the maximum that could be contained in one isofs directory entry / continuation chunk and the process stops once it had encountered 32 CEs, but you can get about 8Kb easily. And that's what will be passed to readdir callback as the name length. 8Kb copytouser() from a buffer allocated by getfreepage()
References, CVE-ID request and response:
http://seclists.org/oss-sec/2016/q2/363
http://seclists.org/oss-sec/2016/q2/365
Upstream fix:
https://git.kernel.org/linus/99d825822eade8d827a1817357cbf3f889a552d6
A vulnerabilty was found in the Linux kernels hiddev driver. An attacker with permissions to the USB HID device can call an ioctl with the HIDIOCGUSAGES or HIDIOCSUSAGES command, and passes a report id of HIDREPORTIDUNKNOWN range checks that would prevent oversize buffers being copied from userspace to kernel space were bypassed.
The kernel would loop on a a value passed by userspace and can copy memory outside of the intended range. This can corrupt memory located after the struct in memory, duplicating the kernel memory or crashing the system
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=93a2001bdfd5376c3dc2158653034c20392d15c5
A vulnerability in the handling of Transactional Memory on powerpc systems was found. An unprivileged local user can crash the kernel by starting a transaction, suspending it, and then calling any of the exec() class system calls.
Patch:
https://patchwork.ozlabs.org/patch/636776/
Test case:
https://patchwork.ozlabs.org/patch/636774/
CVE request:
http://seclists.org/oss-sec/2016/q2/595
It was found that the Linux kernel's IPv6 implementation mishandles socket option data. A local attacker can abuse concurrent access to the socket options to escalate their privileges, or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.
Upstream patch:
https://github.com/torvalds/linux/commit/45f6fad84cc305103b28d73482b344d7f5b76f39
Last updated 24 July 2024
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. Not all devices support or allow MTU's below 68 octets.
An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation.
The affected code is not enabled on Red Hat Enterprise Linux 6 and 7. The affected code was not included in Red Hat Enterprise Linux 5.
Initial patch: https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html
An integer overflow vulnerability was found in xtalloctableinfo, which on 32-bit systems can lead to small structure allocation and a copyfromuser based heap corruption.
Proposed fix:
patch v1 message: http://marc.info/?l=netfilter-devel&m=145757136822750&w=2 patch v1 thread: http://marc.info/?t=145757149700001&r=1&w=2
patch v2 message: http://marc.info/?l=netfilter-devel&m=145800533813758&w=2 (in netfilter-devel) patch v2 message: http://marc.info/?l=linux-netdev&m=145800538413781&w=2 (in linux-netdev)
CVE request and assignment:
http://seclists.org/oss-sec/2016/q1/581 http://seclists.org/oss-sec/2016/q1/619
A use after free vulnerability was found in pppunregisterchannel function. This is triggered when network namespace is removed while pppasync channel is still registered in it and pppunregisterchannel() tries to access its per-netns data in the defunct namespace.
An attacker who could control this memory that is being used in the defunct namespace could create a denial of service by spinlocking a CPU.
An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1f461dcdd296eecedaffffc6bae2bfa90bd7eb89
CVE request:
http://seclists.org/oss-sec/2016/q2/319
A flaw was discovered in processing setsockopt for 32 bit processes on 64 bit systems. This flaw will allow attackers to alter arbitary kernel memory when unloading a kernel module. This action is usually restricted to root-priveledged users but can also be leveraged if the kernel is compiled with CONFIGUSERNS and CONFIGNETNS and the user is granted elevated priveledges.
This flaw was introduced in commit 52e804c6dfaa,
Upstream fixes
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d04 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e94e0cfb088 http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=bdf533de6968
Discussion on oss-sec: http://www.openwall.com/lists/oss-security/2016/06/24/5
Last updated 24 July 2024
A double free vulnerability was found in netlinkdump, which could cause a denial of service or possibly other unspecified impact.
References:
http://seclists.org/oss-sec/2016/q4/577
http://lists.openwall.net/netdev/2016/05/15/69
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=92964c79b357efd980812c4de5c1fd2ec8bb5520
A flaw was found in the Linux kernel's implementation of setsockopt for the SO{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAPNETADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative. This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
A race condition vulnerability was found in packetsetring that can lead to use after free on a function pointer. This vulnerability can be used to gain kernel code execution for the local attacker capable of creating AFPACKET sockets. This issue was introduced with following commit:
https://github.com/torvalds/linux/commit/f6fb8f100b807378fda19e83e5ac6828b638603a
Quickly plugging in and unplugging a USB hub can lead to a null pointer dereference in kernel (local denial of service) or the USB port to which the hub is connected becomes unusable, for kernel versions 2.6.32 < 4.4. The issue occurs when the USB hub gets disconnected before or while the routine for USB hub activation is running - hubactivate() function.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e50293ef9775c5
External references:
http://www.spinics.net/lists/linux-usb/msg132311.html
CVE-ID request and assignment:
http://seclists.org/oss-sec/2016/q1/404
http://seclists.org/oss-sec/2016/q1/413
A security issue was fixed in kernel 4.4-rc4 resolving the bypassing of filesystem permission checks in overlayfs during the initial copyup.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=acff81ec2c79492b180fade3c2894425cd35a545
Remotely triggerable unbounded recursion in GRE code was found. If a packet has the layout: IPv4 header | GRE header | IPv4 header | GRE header | ... depending on left over stack, it could run the kernel out of stack due to recursion and so crash the kernel.
Reproducer:
https://bugzilla.suse.com/showbug.cgi?id=1001486#c5 https://bugzilla.suse.com/attachment.cgi?id=695327
Discussion threads:
https://marc.info/?t=145920955700002&r=1&w=2 https://marc.info/?t=145928865300005&r=1&w=2
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fac8e0f579695a3ecbc4d3cac369139d7f819971
CVE request+assignment:
http://seclists.org/oss-sec/2016/q4/121 http://seclists.org/oss-sec/2016/q4/125
Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIGVLAN8021Q) OR Virtual eXtensible Local Area Network(CONFIGVXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path; As an unlimited recursion could unfold in both VLAN and TEB modules, leading to a stack corruption in the kernel.
A remote user could use this falw to cause kernel panic by sending maliciously crafted packets to a server that has GRO enabled.
Additional requirement for attacking VLAN is to have 8021q module loaded. Additional requirement for attacking TEB is to have increased MTU.
Upstream patch --------------- -> https://patchwork.ozlabs.org/patch/680412/
It was reported that possible use-after-free vulnerability in keyring facility, possibly leading to local privilege escalation, was found. Function joinsessionkeyring in security/keys/processkeys.c holds a reference to the requested keyring, but if that keyring is the same as the one being currently used by the process, the kernel wouldn't decrease keyring->usage before returning to userspace. The usage field can be possibly overflowed causing use-after-free on the keyring object.
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3a50597de8635cd05133bd12c95681c82fe7b878
References: http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
Red Hat KCS article: https://access.redhat.com/articles/2131021
Upstream patch: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
A flaw was found in the Linux kernel's implementation of mapping ELF PIE binary loading to allow evasion of the stack-guard page protection mechanisms that intend to mitigate this behavior. This issue appears to be limited to i386 based systems.
The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack. Linux Kernel version 4.11.5 is affected.
A flaw was found in the Linux kernel where execution of a PIE binary could allow for an attacker to corrupt memory or match priviledges of accessible setuid binaries on a system.
This is a different issue than CVE-2017-1000371
A race condition issue was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization. A local user able to open a raw packet socket (requires the CAPNETRAW capability) could use this to waste resources in the kernels ring buffer or possibly cause a read-out-of-bounds on the heap possibly panicking the machine.
In a default or common use of Red Hat Enterprise Linux 6 and 7 this issue does not allow an unprivileged local user to use this functionality.
In order to exploit this issue the attacker needs CAPNETRAW capability, which needs to be granted by the administrator to the attacker's account. Since Red Hat Enterprise Linux does not have unprivileged user namespaces enabled by default, local unprivileged users also cannot abuse namespaces to grant this capability.
Upstream patch: http://patchwork.ozlabs.org/patch/800274/