CVE-2017-1000112

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.

This kernel update is based on upstream 4.9.43 and fixes at least the following security issues:

The curseg->segno call in f2fs driver can be malformed so that it will have a value that triggers an out of boundary write that could cause memory corruption on the affected devices, leading to code execution in the kernel context. This would allow for more data to be accessed and controlled by the malware (CVE-2017-10663).

The UDP Fragmentation Offload (UFO) feature is vulnerable to out-of-bounds writes causing exploitable memory corruption. If unprivileged user namespaces are available, this bug can be exploited to gain root privileges (CVE-2017-1000112).

For other upstream fixes in this update, read the referenced changelogs.

This kernel update is based on upstream 4.4.82 and fixes at least the following security issues:

The curseg->segno call in f2fs driver can be malformed so that it will have a value that triggers an out of boundary write that could cause memory corruption on the affected devices, leading to code execution in the kernel context. This would allow for more data to be accessed and controlled by the malware (CVE-2017-10663).

The UDP Fragmentation Offload (UFO) feature is vulnerable to out-of-bounds writes causing exploitable memory corruption. If unprivileged user namespaces are available, this bug can be exploited to gain root privileges (CVE-2017-1000112).

For other upstream fixes in this update, read the referenced changelogs.

This kernel-linus update is based on upstream 4.9.43 and fixes at least the following security issues:

The curseg->segno call in f2fs driver can be malformed so that it will have a value that triggers an out of boundary write that could cause memory corruption on the affected devices, leading to code execution in the kernel context. This would allow for more data to be accessed and controlled by the malware (CVE-2017-10663).

The UDP Fragmentation Offload (UFO) feature is vulnerable to out-of-bounds writes causing exploitable memory corruption. If unprivileged user namespaces are available, this bug can be exploited to gain root privileges (CVE-2017-1000112).

For other upstream fixes in this update, read the referenced changelogs.

This kernel-tmb update is based on upstream 4.4.82 and fixes at least the following security issues:

The curseg->segno call in f2fs driver can be malformed so that it will have a value that triggers an out of boundary write that could cause memory corruption on the affected devices, leading to code execution in the kernel context. This would allow for more data to be accessed and controlled by the malware (CVE-2017-10663).

The UDP Fragmentation Offload (UFO) feature is vulnerable to out-of-bounds writes causing exploitable memory corruption. If unprivileged user namespaces are available, this bug can be exploited to gain root privileges (CVE-2017-1000112).

For other upstream fixes in this update, read the referenced changelogs.

This kernel-tmb update is based on upstream 4.9.43 and fixes at least the following security issues:

The curseg->segno call in f2fs driver can be malformed so that it will have a value that triggers an out of boundary write that could cause memory corruption on the affected devices, leading to code execution in the kernel context. This would allow for more data to be accessed and controlled by the malware (CVE-2017-10663).

The UDP Fragmentation Offload (UFO) feature is vulnerable to out-of-bounds writes causing exploitable memory corruption. If unprivileged user namespaces are available, this bug can be exploited to gain root privileges (CVE-2017-1000112).

For other upstream fixes in this update, read the referenced changelogs.

This kernel-linus update is based on upstream 4.4.82 and fixes at least the following security issues:

The curseg->segno call in f2fs driver can be malformed so that it will have a value that triggers an out of boundary write that could cause memory corruption on the affected devices, leading to code execution in the kernel context. This would allow for more data to be accessed and controlled by the malware (CVE-2017-10663).

The UDP Fragmentation Offload (UFO) feature is vulnerable to out-of-bounds writes causing exploitable memory corruption. If unprivileged user namespaces are available, this bug can be exploited to gain root privileges (CVE-2017-1000112).

For other upstream fixes in this update, read the referenced changelogs.

The SUSE Linux Enterprise 12 SP2 kernel was updated to 4.4.74 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-1000111: fix race condition in net-packet code that could be exploited to cause out-of-bounds memory access (bsc#1052365).
• CVE-2017-1000112: fix race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311).

The following non-security bugs were fixed:

• powerpc/numa: fix regression that could cause kernel panics during installation (bsc#1048914).
• bcache: force trigger gc (bsc#1038078).
• bcache: only recovery I/O error for writethrough mode (bsc#1043652).

The SUSE Linux Enterprise 12 kernel was updated to 3.12.61 to the following security updates:

• CVE-2017-1000111: fix race condition in net-packet code that could be exploited to cause out-of-bounds memory access (bsc#1052365).
• CVE-2017-1000112: fix race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311).

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.74 to the following security updates:

• CVE-2017-1000111: fix race condition in net-packet code that could be exploited to cause out-of-bounds memory access (bsc#1052365).
• CVE-2017-1000112: fix race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311).

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.82 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-1000111: Fixed a race condition in net-packet code that could be exploited to cause out-of-bounds memory access (bsc#1052365).
• CVE-2017-1000112: Fixed a race condition in net-packet code that could have been exploited by unprivileged users to gain root access. (bsc#1052311).
• CVE-2017-8831: The saa7164_bus_get function in drivers/media/pci/saa7164/saa7164-bus.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact by changing a certain sequence-number value, aka a 'double fetch' vulnerability (bnc#1037994).
• CVE-2017-7542: The ip6_find_1stfragopt function in net/ipv6/output_core.c in the Linux kernel allowed local users to cause a denial of service (integer overflow and infinite loop) by leveraging the ability to open a raw socket (bnc#1049882).
• CVE-2017-11473: Buffer overflow in the mp_override_legacy_irq() function in arch/x86/kernel/acpi/boot.c in the Linux kernel allowed local users to gain privileges via a crafted ACPI table (bnc#1049603).
• CVE-2017-7533: Race condition in the fsnotify implementation in the Linux kernel allowed local users to gain privileges or cause a denial of service (memory corruption) via a crafted application that leverages simultaneous execution of the inotify_handle_event and vfs_rename functions (bnc#1049483 bnc#1050677).
• CVE-2017-7541: The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux kernel allowed local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted NL80211_CMD_FRAME Netlink packet (bnc#1049645).
• CVE-2017-10810: Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/virtgpu_object.c in the Linux kernel allowed attackers to cause a denial of service (memory consumption) by triggering object-initialization failures (bnc#1047277).

The following non-security bugs were fixed:

• acpi/nfit: Add support of NVDIMM memory error notification in ACPI 6.2 (bsc#1052325).
• acpi/nfit: Issue Start ARS to retrieve existing records (bsc#1052325).
• acpi / processor: Avoid reserving IO regions too early (bsc#1051478).
• acpi / scan: Prefer devices without _HID for _ADR matching (git-fixes).
• Add 'shutdown' to 'struct class' (bsc#1053117).
• af_key: Add lock to key dump (bsc#1047653).
• af_key: Fix slab-out-of-bounds in pfkey_compile_policy (bsc#1047354).
• alsa: fm801: Initialize chip after IRQ handler is registered (bsc#1031717).
• alsa: hda - add more ML register definitions (bsc#1048356).
• alsa: hda - add sanity check to force the separate stream tags (bsc#1048356).
• alsa: hda: Add support for parsing new HDA capabilities (bsc#1048356).
• alsa: hdac: Add support for hda DMA Resume capability (bsc#1048356).
• alsa: hdac_regmap - fix the register access for runtime PM (bsc#1048356).
• alsa: hda: Fix cpu lockup when stopping the cmd dmas (bsc#1048356).
• alsa: hda - Fix endless loop of codec configure (bsc#1031717).
• alsa: hda: fix to wait for RIRB & CORB DMA to set (bsc#1048356).
• alsa: hda - Loop interrupt handling until really cleared (bsc#1048356).
• alsa: hda - move bus_parse_capabilities to core (bsc#1048356).
• alsa: hda - set input_path bitmap to zero after moving it to new place (bsc#1031717).
• alsa: hda - set intel audio clock to a proper value (bsc#1048356).
• arm64: kernel: restrict /dev/mem read() calls to linear region (bsc#1046651).
• arm64: mm: remove page_mapping check in __sync_icache_dcache (bsc#1040347).
• arm64: Update config files. Disable DEVKMEM
• b43: Add missing MODULE_FIRMWARE() (bsc#1037344).
• bcache: force trigger gc (bsc#1038078).
• bcache: only recovery I/O error for writethrough mode (bsc#1043652).
• bcache: only recovery I/O error for writethrough mode (bsc#1043652). -…

This update for the Linux Kernel 3.12.67-60_64_24 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.67-60_64_21 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.74-60_64_40 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.69-60_64_29 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.62-60_64_8 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.62-60_64_8 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.74-60_64_45 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.69-60_64_32 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.74-60_64_48 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.69-60_64_35 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.67-60_64_18 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.74-60_64_54 fixes several issues.

The following security bugs were fixed:

• CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel was too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bsc#1038564, bsc#1042892).
• CVE-2017-8890: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call (bsc#1038564).

This update for the Linux Kernel 3.12.74-60_64_51 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).
• CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel was too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bsc#1038564, bsc#1042892).
• CVE-2017-8890: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call (bsc#1038564).

This update for the Linux Kernel 3.12.74-60_64_57 fixes several issues.

The following security bugs were fixed:

• CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel was too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bsc#1038564, bsc#1042892).
• CVE-2017-8890: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel allowed attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call (bsc#1038564).

This update for the Linux Kernel 4.4.21-84 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.59-92_17 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.74-92_35 fixes one issue.

The following security bugs were fixed:

This update for the Linux Kernel 4.4.49-92_11 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.21-81 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.21-90 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.59-92_20 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.49-92_14 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.59-92_24 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.38-93 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.74-92_29 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.74-92_32 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 4.4.21-69 fixes several issues.

The following security bugs were fixed:

• CVE-2017-1000112: Prevent a race condition in net-packet code that could have been exploited by unprivileged users to gain root access (bsc#1052368).

This update for the Linux Kernel 3.12.61-52_86 fixes several issues.

The following security bugs were fixed:

• CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel was too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bsc#1042892).
• CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a long RPC reply (bsc#1046191).

This update for the Linux Kernel 3.12.61-52_89 fixes several issues.

The following security bugs were fixed:

• CVE-2017-9242: The __ip6_append_data function in net/ipv6/ip6_output.c in the Linux kernel was too late in checking whether an overwrite of an skb data structure may occur, which allowed local users to cause a denial of service (system crash) via crafted system calls (bsc#1042892).
• CVE-2017-7645: The NFSv2/NFSv3 server in the nfsd subsystem in the Linux kernel allowed remote attackers to cause a denial of service (system crash) via a long RPC reply (bsc#1046191).