validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom in kernel-net CVE-2015-2686 critical [released]

Tracked by Jolla (In release)

asked 2017-05-09 12:58:29 +0200

This post is a wiki. Anyone with karma >75 is welcome to improve it.

updated 2017-05-23 19:16:57 +0200

lpr
4819 ●186 ●253 ●257

Description
net/socket.c in the Linux kernel - not just 3.19 http://www.securityfocus.com/bid/73286 - before 3.19.3 does not validate certain range data for (1) sendto and (2) recvfrom system calls, which allows local users to gain privileges by leveraging a subsystem that uses the copy_from_iter function in the iov_iter interface, as demonstrated by the Bluetooth subsystem. CVSSv3 7.8 high (attack range: local)

Upstream-Commit is available.

File affected: kernel-adaptation-sbj-3.4.108.20161101.1/net/socket.c lines:1707-1712; 1766-1771

edit20170523: seems to be rejected, why?

edit retag flag offensive reopen delete

The question has been closed for the following reason "released in a software update" by lpr
close date 2017-07-24 21:09:51.698006

Comments

@jovirkku why is this "Rejected"?

lpr ( 2017-05-23 12:29:26 +0200 )edit

@veskuh seems not to be too hard to fix this (4-liner), CVSSv3 base score 7.8 high, so why is it rejected?

lpr ( 2017-05-23 12:39:10 +0200 )edit

because in the Linux kernel 3.19 before 3.19.3

coderus ( 2017-05-23 14:14:51 +0200 )edit

@coderusas you may know: Linux kernel 3.19 before 3.19.3 means Linux kernel 3.19 vanilla before 3.19.3 vanilla

lpr ( 2017-05-23 15:08:14 +0200 )edit

we have no devices running 3.19 kernels :D

coderus ( 2017-05-23 18:17:25 +0200 )edit

Comments

this should be verified: according to google all Nexus devices are affected AND not all Nexus use 3.19 . the fix is just a check if range is ok, so you should check it independently what routine this is fed to

lpr ( 2017-05-23 15:12:18 +0200 )edit

you are wrong: http://www.securityfocus.com/bid/73286

lpr ( 2017-05-23 17:23:03 +0200 )edit

you got official Jolla reject, engineers checked kernels, and out kernels are not affected by this problem, so please calm down.

coderus ( 2017-05-23 18:18:29 +0200 )edit

how many sockets per second do you open that you cannot afford this range check in no way????

lpr ( 2017-05-23 19:05:46 +0200 )edit

regarding this list none of community ports have the kernels. BUT the lpr intervention let me have a question. How will jolla do to remind themselves for the day when someone will use these kernel generation?
Is that not a problem (because at this moment the kernel will be fixed)?
Or It will be a problem indeed because of forgotten?
Is just a neutral question....
Anyway to calm down is a good suggestion ;-)

cemoi71 ( 2017-05-23 19:31:30 +0200 )edit

validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom in kernel-net CVE-2015-2686 critical [released]

The question has been closed for the following reason "released in a software update" by lpr
close date 2017-07-24 21:09:51.698006

Comments

1 Answer

Comments

Question tools

Stats

Related questions

validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom in kernel-net CVE-2015-2686 critical [released]

The question has been closed for the following reason "released in a software update" by lpr close date 2017-07-24 21:09:51.698006

Comments

1 Answer

Comments

Question tools

Public thread

Stats

Related questions

The question has been closed for the following reason "released in a software update" by lpr
close date 2017-07-24 21:09:51.698006