Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1479307 (CVE-2017-1000112)
Summary: | CVE-2017-1000112 kernel: Exploitable memory corruption due to UFO to non-UFO path switch | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | unspecified | CC: | aquini, bhu, blc, dhoward, fhrbata, gansalmon, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, madhu.chinakonda, matt, mchehab, mcressma, mlangsdo, mleitner, mmilgram, nmurray, pholasek, plougher, rt-maint, rvrbovsk, santony, security-response-team, slawomir, vdronov, williams, wmealing, yozone |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: |
An exploitable memory corruption flaw was found in the Linux kernel. The append path can be erroneously switched from UFO to non-UFO in ip_ufo_append_data() when building an UFO packet with MSG_MORE option. If unprivileged user namespaces are available, this flaw can be exploited to gain root privileges.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2019-06-08 03:20:10 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1480465, 1481529, 1481530, 1481531, 1481532, 1481533, 1481534, 1481535, 1481536, 1481537, 1640510, 1725185 | ||
Bug Blocks: |
Description
Andrej Nemec
2017-08-08 10:49:42 UTC
Acknowledgments: Name: Andrey Konovalov Public via: http://seclists.org/oss-sec/2017/q3/277 Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1480465] Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5,6, 7 and MRG-2. Future Linux kernel updates for the respective releases may address this issue. Additional information: This mainly affects systems that have UFO (UDP fragment offload) enabled. You can see if this is configured on or off with the ethool command: # ethtool -k em1 |grep "udp-fragmentation-offload:" udp-fragmentation-offload: off [fixed] If enabled, disabling the UDP fragementation offload will mitigate this flaw and is documented in this solution: https://access.redhat.com/solutions/2127401 This issue has been addressed in the following products: Red Hat Enterprise MRG 2 Via RHSA-2017:2918 https://access.redhat.com/errata/RHSA-2017:2918 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:2930 https://access.redhat.com/errata/RHSA-2017:2930 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:2931 https://access.redhat.com/errata/RHSA-2017:2931 This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2017:3200 https://access.redhat.com/errata/RHSA-2017:3200 This issue has been addressed in the following products: Red Hat Enterprise Linux 5.9 Long Life Via RHSA-2019:1932 https://access.redhat.com/errata/RHSA-2019:1932 This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Extended Lifecycle Support Via RHSA-2019:1931 https://access.redhat.com/errata/RHSA-2019:1931 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.3 Telco Extended Update Support Red Hat Enterprise Linux 7.3 Advanced Update Support Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions Via RHSA-2019:4159 https://access.redhat.com/errata/RHSA-2019:4159 |