oss-security - CVE-2016-6327 | Linux kernel crash in infiniband subsystem.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALJHwhQEOavmdQ_dqNS2k5b1SFuvKUBTuQtOySi6zUfgSQ3-1Q@mail.gmail.com>
Date: Fri, 19 Aug 2016 17:10:30 +1000
From: Wade Mealing <wmealing@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2016-6327 | Linux kernel crash in infiniband subsystem.

System using the infiniband support module ib_srpt were vulnerable to
a denial of service by system crash by a local attacker who is able to
abort writes to a device using this initiator.

There were multiple areas in which aborting a scsi command are able to
be handled, moving this to the correct location in the state machine
ensured that this condition was never triggered through this code
path.

The null pointer situation was enabled via a non attacker controlled
meset() call, and this is not a use after free.  From my undestanding
it is a denial of service only.

Thanks,

Wade Mealing

https://bugzilla.redhat.com/show_bug.cgi?id=1354525
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51093254bf87

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.