[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CALJHwhRSR+vkuO9fn_d1-Ui9=eWsfd73QCLNi6zc7egL+zM7Fg@mail.gmail.com>
Date: Tue, 17 May 2016 11:01:17 +1000
From: Wade Mealing <wmealing@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2016-3707 : kernel-rt - Sending SysRq command via ICMP echo request
Gday,
A flaw was found in the kernel-rt in which an attacker could submit a
specially crafted ICMP echo request which can trigger a sysrq function
based on values in the ICMP packet.
This feature was introduced in the kernel-rt only and is not shipping
with standard Red Hat Enterprise Linux kernels. Other kernels also
ship this patch.
When enabled, remote attacker who are able to send ICMP packets to the
host could exploit this feature using bruteforce to submit arbitrary
SysRq commands.
A local user can find the cookie immediately by inspecting the cookie file:
$ ls -l /proc/sys/net/ipv4/icmp_echo_sysrq
-rw-r--r--. 1 root root 0 Apr 28 15:39 /proc/sys/net/ipv4/icmp_echo_sysrq
This pattern in hex can be used to attack the host with the
icmp_echo_sysrq cookie set (and sysrq enabled) as per this example:
# ping -c1 -s57 -p0102030468 <target>
Remote attacker could exploit this feature using bruteforce to submit
arbitrary SysRq commands if this feature was enabled.
There is no fix for this at the time, this feature can be disabled /
reverted in the code and usual methods of sysrq magic keys can be used
as a workaround till a sufficient alternative has been developed.
Resources:
https://www.kernel.org/pub/linux/kernel/projects/rt/4.4/patch-4.4.7-rt16.patch.gz
Upstream discussion on original topic:
https://lwn.net/Articles/448790/
Red Hat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-3707
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
