New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 673759 link

Starred by 1 user

Issue metadata

Status: Duplicate
Owner:
Closed: Dec 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: CVE-2016-8655 Linux af_packet.c race condition (local root)

Project Member Reported by jorgelo@chromium.org, Dec 13 2016

Issue description

CVE-2016-8655 is a race-condition in Linux (net/packet/af_packet.c). It can be exploited to gain kernel code execution from unprivileged processes.

VERSION
Linux kernel through 4.8.12.

REPRODUCTION CASE
See http://seclists.org/oss-sec/2016/q4/607

This is exploitable from unprivileged users via user namespaces.
 
Cc: groeck@chromium.org
Components: OS>Kernel
Owner: snanda@chromium.org
Fix: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c

snanda@, can someone on the kernel team take this on?
Cc: bhthompson@chromium.org
Labels: Security_Severity-High M-55 Security_Impact-Stable
Marking this as severity high / P1 for now, given that there's no indication of this being actively exploited. POC is available though, which arguably justifies P0...

Adding M-55 label and cc-ing bhthompson@: I recommend patching this quickly.

I'll see whether I can get CLs up before west coast wakes up.
Mergedinto: 672642
Status: Duplicate (was: Available)
Turns out we already have a bug for this, marking as duplicate.
Project Member

Comment 4 by sheriffbot@chromium.org, Mar 22 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment