oss-security - CVE-2017-7184: kernel: Local privilege escalation in XFRM framework

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <f7bff499-47e8-c5f2-e867-eb7f7bf329d8@canonical.com>
Date: Wed, 29 Mar 2017 16:43:28 -0500
From: Tyler Hicks <tyhicks@...onical.com>
To: oss-security@...ts.openwall.com
Cc: "security@...ntu.com" <security@...ntu.com>
Subject: CVE-2017-7184: kernel: Local privilege escalation in XFRM framework

A security issue was reported by ZDI, on behalf of Chaitin Security
Research Lab, against the Linux kernel in Ubuntu. It also affected the
upstream kernel.

Chaitin Security Research Lab discovered that xfrm_replay_verify_len(),
as called by xfrm_new_ae(), did not verify that the user-specified
replay_window was within the replay state buffer.

This allowed for out-of-bounds reads and writes of kernel memory.
Chaitin Security showed that this can lead to local privilege escalation
by using user namespaces in order to configure XFRM. XFRM configuration
requires CAP_NET_ADMIN so this issue is mitigated in kernels which do
not enable user namespaces by default.

Fixes:
- https://git.kernel.org/linus/677e806da4d916052585301785d847c3b3e6186a
- https://git.kernel.org/linus/f843ee6dd019bcece3e74e76ad9df0155655d0df

Tyler

Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.