FROM $URL: Hi there, I found a memory corruption vulnerabiliry in Linux kernel through 4.6.2, and I have a working exploit to escalade privileges which requires the ip6_tables module to be loaded, that it is properly blocked on all up-to-date versions. Due to the number of users running vulnerable code(not update to 4.7 or higher), and that this exploit is only available to security researchers and kernel packagers upon request but that I don't want it to spread. I have reported this issue to Linux kernel official and they have already fixed this. And I would like to request CVE-ID for this issue. DESCRIPTION =========== The IPv6 netfilter subsystem in the Linux kernel through 4.6.2 does not validate certain offset fields, which allows local users to escalade privileges via an IP6T_SO_SET_REPLACE compat setsockopt call PRODUCTS AFFECTED ================== Linux Kernel through 4.6.2 Ubuntu 14.04 Ubuntu 16.04 VULNERABILITY DETAILS ==================== In net/ipv6/netfilter/ip6_tables.c:1490 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e, . . .) { xt_ematch_foreach(ematch, e) { ret = compat_find_calc_match(ematch, &e->ipv6, &off); if (ret != 0) goto release_matches; ++j; } t = compat_ip6t_get_target(e); target = xt_request_find_target(NFPROTO_IPV6, t->u.user.name, t->u.user.revision); t->u.kernel.target = target; } struct xt_entry_target * compat_ip6t_get_target(struct compat_ip6t_entry *e) { return (void *)e + e->target_offset; } /* can only be xt_entry_match, so no use of typeof here */ #define xt_ematch_foreach(pos, entry) \ for ((pos) = (struct xt_entry_match *)entry->elems; \ (pos) < (struct xt_entry_match *)((char *)(entry) + \ (entry)->target_offset); \ (pos) = (struct xt_entry_match *)((char *)(pos) + \ (pos)->u.match_size)) The entry->target_offset field didn��t verification well, so that it can cause a memory corruption via t->u.kernel.target = target CREDIT ====== This issue was discovered by Qian Zhang@...velTeam Qihoo 360 PATCH =========== http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce683e5f9d045e5d67d1312a42b359cb2ab2a13c regards, Qian Zhang@...velTeam Qihoo 360
@MPAGANO: Could you check which LTS version we need to stabilize? @BLUENESS: I guess the latest hardened is affected.
Fix in 4.7
