oss-security - Re: CVE-2016-6327 | Linux kernel crash in infiniband subsystem.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160819073154.GA21382@kroah.com>
Date: Fri, 19 Aug 2016 09:31:54 +0200
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2016-6327 | Linux kernel crash in infiniband
 subsystem.

On Fri, Aug 19, 2016 at 05:10:30PM +1000, Wade Mealing wrote:
> System using the infiniband support module ib_srpt were vulnerable to
> a denial of service by system crash by a local attacker who is able to
> abort writes to a device using this initiator.
> 
> There were multiple areas in which aborting a scsi command are able to
> be handled, moving this to the correct location in the state machine
> ensured that this condition was never triggered through this code
> path.
> 
> The null pointer situation was enabled via a non attacker controlled
> meset() call, and this is not a use after free.  From my undestanding
> it is a denial of service only.
> 
> Thanks,
> 
> Wade Mealing
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1354525
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51093254bf87

For those playing at home, this was fixed in the 4.6 Linux kernel
release, as well as the 4.4.7 stable release (released on April 12,
2016), and all other stable releases around the same time, so the only
ones to worry about this are those who have not updated their kernel in
a long time.

thanks,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.