SB2016101402 - Denial of service in Linux Kernel

Description

This security bulletin contains information about 2 vulnerabilities.

1) Uncontrolled recursion (CVE-ID: CVE-2016-8666)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrollable recursion when parsing IPv4 and GRE headers. A remote attacker can force the kernel to use GRO path for packets with tunnel stacking and perform a denial of service attack.

2) Denial of service (CVE-ID: CVE-2016-8660)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local nonprivileged user to cause DoS conditions on the target system.
The weakness exists due to insufficient access control. By using the vfs syscall group in the trinity program, related to a "page lock order bug in the XFS seek hole/data implementation", attackers can trigger fdatasync failure and system hang.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.

Remediation

Install update from vendor's website.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1384991
• https://github.com/torvalds/linux/commit/fac8e0f579695a3ecbc4d3cac369139d7f819971
• https://bugzilla.redhat.com/show_bug.cgi?id=1384851