CrOS: Vulnerability reported in Linux kernel (CVE-2017-7487) |
|||||||||||||||||
Issue descriptionVOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. Advisory: CVE-2017-7487 Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-7487 CVSS severity score: 7.2/10.0 Description: The ipxitf_ioctl function in net/ipx/af_ipx.c in the Linux kernel through 4.11.1 mishandles reference counts, which allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface. This bug was filed by http://go/vomit Please contact us at vomit-team@google.com if you need any assistance.
,
May 24 2017
,
May 24 2017
We don't have CONFIG_IPX enabled in any of our kernel configurations (still need to check Lakitu though). Unless Lakitu enables it, we should get the problem fixed, but applying to stable releases would in that case appear unnecessary. I'll check the lakitu configuration later and update the bug accordingly.
,
May 24 2017
Checked through Lakitu and other out-of-tree configurations. CONFIG_IPX is not enabled anywhere. Lowering severity and dropping M-58 as well as security-impact-stable.
,
May 24 2017
,
May 25 2017
,
May 25 2017
Removing the Bug-Security type since this doesn't affect our users.
,
May 25 2017
,
Sep 9 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/8f2bfa980ab0de1a9a91805a2eb599e67c9d860d commit 8f2bfa980ab0de1a9a91805a2eb599e67c9d860d Author: Dan Carpenter <dan.carpenter@oracle.com> Date: Sat Sep 09 00:35:41 2017 UPSTREAM: ipx: call ipxitf_put() in ioctl error path We should call ipxitf_put() if the copy_to_user() fails. BUG= chromium:725862 TEST=Build and run Change-Id: Id29ee7cc7d745b03cf66eb57d6e7d545056e5429 Reported-by: <liqiang6-s@360.cn> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from upstream commit ee0d8d8482345ff97a75a7d747efc309f13b0d80) Reviewed-on: https://chromium-review.googlesource.com/513420 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/653659 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> [modify] https://crrev.com/8f2bfa980ab0de1a9a91805a2eb599e67c9d860d/net/ipx/af_ipx.c
,
Sep 9 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/858925ee7a2522e2adf6fe6c39961e8daca104e4 commit 858925ee7a2522e2adf6fe6c39961e8daca104e4 Author: Dan Carpenter <dan.carpenter@oracle.com> Date: Sat Sep 09 00:35:50 2017 UPSTREAM: ipx: call ipxitf_put() in ioctl error path We should call ipxitf_put() if the copy_to_user() fails. BUG= chromium:725862 TEST=Build and run Change-Id: Id29ee7cc7d745b03cf66eb57d6e7d545056e5429 Reported-by: <liqiang6-s@360.cn> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from upstream commit ee0d8d8482345ff97a75a7d747efc309f13b0d80) Reviewed-on: https://chromium-review.googlesource.com/513420 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/654219 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> [modify] https://crrev.com/858925ee7a2522e2adf6fe6c39961e8daca104e4/net/ipx/af_ipx.c
,
Sep 9 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/1e365118add18f1e0b9d2f5b9253a84a59f59631 commit 1e365118add18f1e0b9d2f5b9253a84a59f59631 Author: Dan Carpenter <dan.carpenter@oracle.com> Date: Sat Sep 09 03:04:30 2017 UPSTREAM: ipx: call ipxitf_put() in ioctl error path We should call ipxitf_put() if the copy_to_user() fails. BUG= chromium:725862 TEST=Build and run Change-Id: Id29ee7cc7d745b03cf66eb57d6e7d545056e5429 Reported-by: <liqiang6-s@360.cn> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from upstream commit ee0d8d8482345ff97a75a7d747efc309f13b0d80) Reviewed-on: https://chromium-review.googlesource.com/513420 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/654218 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> [modify] https://crrev.com/1e365118add18f1e0b9d2f5b9253a84a59f59631/net/ipx/af_ipx.c
,
Sep 9 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/f3c13afb18d481f63eb5a4db7a2f67be0f771fc8 commit f3c13afb18d481f63eb5a4db7a2f67be0f771fc8 Author: Dan Carpenter <dan.carpenter@oracle.com> Date: Sat Sep 09 22:23:51 2017 UPSTREAM: ipx: call ipxitf_put() in ioctl error path We should call ipxitf_put() if the copy_to_user() fails. BUG= chromium:725862 TEST=Build and run Change-Id: Id29ee7cc7d745b03cf66eb57d6e7d545056e5429 Reported-by: <liqiang6-s@360.cn> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from upstream commit ee0d8d8482345ff97a75a7d747efc309f13b0d80) Reviewed-on: https://chromium-review.googlesource.com/513420 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/654002 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> [modify] https://crrev.com/f3c13afb18d481f63eb5a4db7a2f67be0f771fc8/net/ipx/af_ipx.c
,
Sep 11 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/232357f544414542d81f65b539078b0b1b976116 commit 232357f544414542d81f65b539078b0b1b976116 Author: Dan Carpenter <dan.carpenter@oracle.com> Date: Mon Sep 11 17:24:00 2017 UPSTREAM: ipx: call ipxitf_put() in ioctl error path We should call ipxitf_put() if the copy_to_user() fails. BUG= chromium:725862 TEST=Build and run Change-Id: Id29ee7cc7d745b03cf66eb57d6e7d545056e5429 Reported-by: <liqiang6-s@360.cn> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from upstream commit ee0d8d8482345ff97a75a7d747efc309f13b0d80) Reviewed-on: https://chromium-review.googlesource.com/513420 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/653659 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> (cherry picked from commit 8f2bfa980ab0de1a9a91805a2eb599e67c9d860d) Reviewed-on: https://chromium-review.googlesource.com/660869 Reviewed-by: Bernie Thompson <bhthompson@chromium.org> Commit-Queue: Bernie Thompson <bhthompson@chromium.org> [modify] https://crrev.com/232357f544414542d81f65b539078b0b1b976116/net/ipx/af_ipx.c
,
Sep 11 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/0460440904907db5849fb3d6172b2f9de692932e commit 0460440904907db5849fb3d6172b2f9de692932e Author: Dan Carpenter <dan.carpenter@oracle.com> Date: Mon Sep 11 17:32:44 2017 UPSTREAM: ipx: call ipxitf_put() in ioctl error path We should call ipxitf_put() if the copy_to_user() fails. BUG= chromium:725862 TEST=Build and run Change-Id: Id29ee7cc7d745b03cf66eb57d6e7d545056e5429 Reported-by: <liqiang6-s@360.cn> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from upstream commit ee0d8d8482345ff97a75a7d747efc309f13b0d80) Reviewed-on: https://chromium-review.googlesource.com/513420 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/654219 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> (cherry picked from commit 858925ee7a2522e2adf6fe6c39961e8daca104e4) Reviewed-on: https://chromium-review.googlesource.com/661037 Reviewed-by: Bernie Thompson <bhthompson@chromium.org> Commit-Queue: Bernie Thompson <bhthompson@chromium.org> [modify] https://crrev.com/0460440904907db5849fb3d6172b2f9de692932e/net/ipx/af_ipx.c
,
Sep 11 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/ef6f3d27c773db21dae2ae92dbae740dd20bc5b9 commit ef6f3d27c773db21dae2ae92dbae740dd20bc5b9 Author: Dan Carpenter <dan.carpenter@oracle.com> Date: Mon Sep 11 17:37:01 2017 UPSTREAM: ipx: call ipxitf_put() in ioctl error path We should call ipxitf_put() if the copy_to_user() fails. BUG= chromium:725862 TEST=Build and run Change-Id: Id29ee7cc7d745b03cf66eb57d6e7d545056e5429 Reported-by: <liqiang6-s@360.cn> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from upstream commit ee0d8d8482345ff97a75a7d747efc309f13b0d80) Reviewed-on: https://chromium-review.googlesource.com/513420 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/654218 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> (cherry picked from commit 1e365118add18f1e0b9d2f5b9253a84a59f59631) Reviewed-on: https://chromium-review.googlesource.com/661046 Reviewed-by: Bernie Thompson <bhthompson@chromium.org> Commit-Queue: Bernie Thompson <bhthompson@chromium.org> [modify] https://crrev.com/ef6f3d27c773db21dae2ae92dbae740dd20bc5b9/net/ipx/af_ipx.c
,
Sep 11 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/45d5aec18cebdd3f7bff96ea5d852001e3a0c8c8 commit 45d5aec18cebdd3f7bff96ea5d852001e3a0c8c8 Author: Dan Carpenter <dan.carpenter@oracle.com> Date: Mon Sep 11 17:39:26 2017 UPSTREAM: ipx: call ipxitf_put() in ioctl error path We should call ipxitf_put() if the copy_to_user() fails. BUG= chromium:725862 TEST=Build and run Change-Id: Id29ee7cc7d745b03cf66eb57d6e7d545056e5429 Reported-by: <liqiang6-s@360.cn> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from upstream commit ee0d8d8482345ff97a75a7d747efc309f13b0d80) Reviewed-on: https://chromium-review.googlesource.com/513420 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/654002 Commit-Ready: Bernie Thompson <bhthompson@chromium.org> Tested-by: Bernie Thompson <bhthompson@chromium.org> (cherry picked from commit f3c13afb18d481f63eb5a4db7a2f67be0f771fc8) Reviewed-on: https://chromium-review.googlesource.com/661050 Reviewed-by: Bernie Thompson <bhthompson@chromium.org> Commit-Queue: Bernie Thompson <bhthompson@chromium.org> [modify] https://crrev.com/45d5aec18cebdd3f7bff96ea5d852001e3a0c8c8/net/ipx/af_ipx.c
,
Jan 22 2018
|
|||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||
Comment 1 by kenrb@chromium.org
, May 24 2017Labels: Security_Severity-High Security_Impact-Stable Pri-1