Heap-based buffer overflow in Linux kernel - CVE-2017-7477

Vulnerability identifier: #VU6612

CSH Severity: Medium

CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7477

CWE-ID: CWE-122

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker on the local network execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow in the skb_to_sgvec() function in the MACsec driver. A remote attacker can use a MAX_SKB_FRAGS+1 size in conjunction with the NETIF_F_FRAGLIST feature, trigger memory corruption and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability results in arbitrary code execution.

Linux kernel
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Ubuntu
Fedora

kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel

Install update from vendor's website.

kernel (Red Hat package) - update to 3.10.0-514.26.1.el7
kernel-rt (Red Hat package) - update to 3.10.0-514.26.1.rt56.442.el7
kernel - addressed in versions 4.10.13-100.fc24, 4.10.13-200.fc25, 4.11.0-1.fc26

• https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=4d6fa57b4dab0d77f4d8e9d9c73...

• Remote code execution in Linux kernel
• Red Hat update for Linux Kernel
• Ubuntu update for Linux kernel (HWE)
• Ubuntu update for Linux kernel
• Red Hat update for kernel
• Fedora 25 update for kernel
• Fedora 24 update for kernel
• Fedora 26 update for kernel