Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 605234 (CVE-2016-7039) - kernel: remotely triggerable unbounded recursion in the vlan gro code leading to a kernel crash
Summary: kernel: remotely triggerable unbounded recursion in the vlan gro code leading...
Status: RESOLVED FIXED
Alias: CVE-2016-7039
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Kernel Security
URL:
Whiteboard:
Keywords:
Depends on: 605360
Blocks:
  Show dependency tree
 
Reported: 2017-01-10 01:47 UTC by Thomas Deutschmann (RETIRED)
Modified: 2022-03-25 22:55 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-10 01:47:31 UTC 
Linux kernel built with the 802.1Q/802.1ad VLAN(CONFIG_VLAN_8021Q) OR Virtual eXtensible Local Area Network(CONFIG_VXLAN) with Transparent Ethernet Bridging(TEB) GRO support, is vulnerable to a stack overflow issue. It could occur while receiving large packets via GRO path, as an unlimited recursion could unfold in both VLAN and TEB modules, leading to a stack corruption in the kernel.
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2017-01-10 01:52:43 UTC 
Fixed by: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fcd91dd449867c6bfe56a81cabba76b829fd05cd

Introduced by: https://git.kernel.org/linus/9b174d88c257150562b0101fcc6cb6c3cb74275c (v4.0-rc1)

Intorduced by: https://git.kernel.org/linus/66e5133f19e901a044fa5eaeeb6ecff4545839e5 (v4.2-rc1)


sys-kernel/gentoo-sources overview:
4.4:  Fixed since 4.4.32 (3cb00b90e8b1bd59382f5e1304dd751f9674f027)
4.1:  Fixed since 4.1.37 (fabaaaa96d54077b4a9f2c811e55dc09ff2874db)
Comment 2 Alice Ferrazzi Gentoo Infrastructure gentoo-dev 2017-01-11 09:05:24 UTC 
4.4.41 and 4.1.37 are commited wait for stabilize
Comment 3 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-03-25 22:55:15 UTC 
Fixed in 4.9