oss-security - CVE-2017-7979: Linux kernel: local DoS via packet action API

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20170420080100.3pwt7tgz46xya4ym@nora.maurer-it.com>
Date: Thu, 20 Apr 2017 10:01:00 +0200
From: Fabian Grünbichler <f.gruenbichler@...xmox.com>
To: oss-security@...ts.openwall.com
Cc: Wolfgang Bumiller <w.bumiller@...xmox.com>
Subject: CVE-2017-7979: Linux kernel: local DoS via packet action API

CVE-2017-7979 [1] was assigned to the following issue:

The cookie feature in the packet action API implementation in
net/sched/act_api.c in the Linux kernel 4.11.x through 4.11-rc7
mishandles the tb nlattr array, which allows local users to cause a
denial of service (uninitialized memory access and refcount underflow,
and system hang or crash) or possibly have unspecified other impact via
"tc filter add" commands in certain contexts.

The fix has been sent upstream [2], whether all related issues are fixed by
the two proposed patches (see whole thread at [3]) is still under
discussion.

Not affected:
- Upstream: stable kernels from kernel.org, such as 4.10.x

Affected:
- Upstream: all current 4.11 RCs (rc1-rc7) are affected.
- Ubuntu 17.04: commit 1045ba77a ("net sched actions: Add support for
  user cookies") which introduced the problematic code was backported to
  Ubuntu 17.04's "Ubuntu-4.10.0-15.17" kernel, which is affected[4].
- Proxmox VE 5.0 Beta: the Proxmox VE kernel 4.10.5-1 which was based on
  Ubuntu-4.10.0-15.17 was affected[5], the subsequently released PVE
  kernel 4.10.8-1 contains the fix from [2]. The current PVE stable
  release 4.4 is not affected.

Thanks to Wolfang Bumiller for analysis and proposed fixes.
Thanks to "Ivensiya" <ivensiya@...il.com> for the initial bug report[5]
that lead to the discovery.

1: https://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-7979
2: https://marc.info/?l=linux-netdev&m=149200746116365
3: https://marc.info/?l=linux-netdev&m=149251041420195
4: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1682368
5: https://bugzilla.proxmox.com/show_bug.cgi?id=1351

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.