CVE-2017-1000112

 

Published at: - 05-10-2017 03:29

Last modified: - 26-10-2022 01:44

Total changes: - 3

Description

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.

Common Vulnerability Scoring System (CVSS)

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• 1039162-Third Party Advisory, VDB Entry
• 100262-Third Party Advisory, VDB Entry
• [oss-security] 20170810 Linux kernel: CVE-2017-1000112: Exploitable memory corruption due to UFO to non-UFO path switch-Mailing List, Patch, Third Party Advisory
• DSA-3981-
• RHSA-2017:3200-
• RHSA-2017:2931-
• RHSA-2017:2930-
• RHSA-2017:2918-
• https://github.com/xairy/kernel-exploits/tree/master/CVE-2017-1000112
• 45147-
• RHSA-2019:1931-
• RHSA-2019:1932-
• RHSA-2019:4159-

 

Keywords

NVD

 

CVE-2017-1000112

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures