Cloudanix VulnDB

CVE-2017-1000112

High · 7.0

CVSS

7.0

EPSS

20.8%

Published

Oct 5, 2017

CISA due date

—

The record

Linux kernel: Exploitable memory corruption due to UFO to non-UFO path switch. When building a UFO packet with MSG_MORE __ip_append_data() calls ip_ufo_append_data() to append. However in between two send() calls, the append path can be switched from UFO to non-UFO one, which leads to a memory corruption. In case UFO packet lengths exceeds MTU, copy = maxfraglen - skb->len becomes negative on the non-UFO path and the branch to allocate new skb is taken. This triggers fragmentation and computation of fraggap = skb_prev->len - maxfraglen. Fraggap can exceed MTU, causing copy = datalen - transhdrlen - fraggap to become negative. Subsequently skb_copy_and_csum_bits() writes out-of-bounds. A similar issue is present in IPv6 code. The bug was introduced in e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach") on Oct 18 2005.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 linux 0 4.12.6-1
Debian:11 linux 0 4.12.6-1
Debian:12 linux 0 4.12.6-1
Debian:13 linux 0 4.12.6-1
Debian:8 linux 0 3.16.43-2+deb8u5
Debian:9 linux 0 4.9.30-2+deb9u5
Mageia:5 kernel 0 4.4.82-1.mga5
Mageia:5 kernel-linus 0 4.4.82-1.mga5
Mageia:5 kernel-tmb 0 4.4.82-1.mga5
Mageia:5 kernel-userspace-headers 0 4.4.82-1.mga5
Mageia:5 kmod-vboxadditions 0 5.1.26-2.mga5
Mageia:5 kmod-virtualbox 0 5.1.26-2.mga5
Mageia:5 kmod-xtables-addons 0 2.10-45.mga5
Mageia:6 kernel 0 4.9.43-1.mga6
Mageia:6 kernel-linus 0 4.9.43-1.mga6
Mageia:6 kernel-tmb 0 4.9.43-1.mga6
Mageia:6 kernel-userspace-headers 0 4.9.43-1.mga6
Mageia:6 kmod-vboxadditions 0 5.1.26-2.mga6
Mageia:6 kmod-virtualbox 0 5.1.26-2.mga6
Mageia:6 kmod-xtables-addons 0 2.12-41.mga6
Red Hat:enterprise_linux:6::client kernel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-abi-whitelists 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-bootwrapper 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-debug 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-debug-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-debug-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-debuginfo-common-i686 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-debuginfo-common-ppc64 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-debuginfo-common-s390x 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-debuginfo-common-x86_64 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-doc 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-firmware 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-headers 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-kdump 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-kdump-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client kernel-kdump-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client perf 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client perf-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client python-perf 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::client python-perf-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-abi-whitelists 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-bootwrapper 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-debug 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-debug-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-debug-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-debuginfo-common-i686 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-debuginfo-common-ppc64 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-debuginfo-common-s390x 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-debuginfo-common-x86_64 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-doc 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-firmware 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-headers 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-kdump 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-kdump-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode kernel-kdump-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode perf 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode perf-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode python-perf 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::computenode python-perf-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-abi-whitelists 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-bootwrapper 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-debug 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-debug-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-debug-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-debuginfo-common-i686 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-debuginfo-common-ppc64 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-debuginfo-common-s390x 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-debuginfo-common-x86_64 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-doc 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-firmware 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-headers 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-kdump 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-kdump-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server kernel-kdump-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server perf 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server perf-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server python-perf 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::server python-perf-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-abi-whitelists 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-bootwrapper 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-debug 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-debug-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-debug-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-debuginfo-common-i686 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-debuginfo-common-ppc64 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-debuginfo-common-s390x 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-debuginfo-common-x86_64 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-doc 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-firmware 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-headers 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-kdump 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-kdump-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation kernel-kdump-devel 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation perf 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation perf-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation python-perf 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:6::workstation python-perf-debuginfo 0 0:2.6.32-696.16.1.el6
Red Hat:enterprise_linux:7::client kernel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-abi-whitelists 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-bootwrapper 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-debug 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-debug-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-debug-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-debuginfo-common-ppc64 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-debuginfo-common-ppc64le 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-debuginfo-common-s390x 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-debuginfo-common-x86_64 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-doc 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-headers 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-kdump 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-kdump-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-kdump-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-tools 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-tools-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-tools-libs 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client kernel-tools-libs-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client perf 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client perf-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client python-perf 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::client python-perf-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-abi-whitelists 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-bootwrapper 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-debug 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-debug-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-debug-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-debuginfo-common-ppc64 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-debuginfo-common-ppc64le 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-debuginfo-common-s390x 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-debuginfo-common-x86_64 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-doc 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-headers 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-kdump 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-kdump-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-kdump-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-tools 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-tools-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-tools-libs 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode kernel-tools-libs-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode perf 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode perf-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode python-perf 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::computenode python-perf-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-abi-whitelists 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-bootwrapper 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-debug 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-debug-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-debug-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-debuginfo-common-ppc64 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-debuginfo-common-ppc64le 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-debuginfo-common-s390x 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-debuginfo-common-x86_64 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-doc 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-headers 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-kdump 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-kdump-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-kdump-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-tools 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-tools-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-tools-libs 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server kernel-tools-libs-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server perf 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server perf-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server python-perf 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::server python-perf-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-abi-whitelists 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-bootwrapper 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-debug 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-debug-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-debug-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-debuginfo-common-ppc64 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-debuginfo-common-ppc64le 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-debuginfo-common-s390x 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-debuginfo-common-x86_64 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-devel 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-doc 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-headers 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-kdump 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-kdump-debuginfo 0 0:3.10.0-693.5.2.el7
Red Hat:enterprise_linux:7::workstation kernel-kdump-devel 0 0:3.10.0-693.5.2.el7

Related vulnerabilities