VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2018-1065
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-1065
CVSS severity score: 4.7/10.0
Description:
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but lacks a user-defined chain, which allows local users to cause a denial of service (NULL pointer dereference) by leveraging the CAP_NET_RAW or CAP_NET_ADMIN capability, related to arpt_do_table in net/ipv4/netfilter/arp_tables.c, ipt_do_table in net/ipv4/netfilter/ip_tables.c, and ip6t_do_table in net/ipv6/netfilter/ip6_tables.c.
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by zsm@chromium.org
, Mar 23 2018Labels: Security_Severity-Low Security_Impact-None Pri-3
Owner: zsm@chromium.org
Status: WontFix (was: Untriaged)
Fix is 57ebd808a("netfilter: add back stackpointer size checks"). Fix is present on 4.14, 4.4. Fix is not required on 3.18, 3.14, 3.10, 3.8 as the patch introducing the bug is not present(7814b6e ("netfilter: xtables: don't save/restore jumpstack offset")) Marking this bug as WontFix.