CVE-2016-3135
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
Medium
|
Tim Gardner | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Fix Released
|
Medium
|
Chris J Arges | ||
Xenial |
Fix Released
|
Medium
|
Tim Gardner | ||
Yakkety |
Fix Released
|
Medium
|
Tim Gardner | ||
linux-armadaxp (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-flo (Ubuntu) |
New
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
New
|
Medium
|
Unassigned | ||
Xenial |
New
|
Medium
|
Unassigned | ||
Yakkety |
New
|
Medium
|
Unassigned | ||
linux-goldfish (Ubuntu) |
New
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
New
|
Medium
|
Unassigned | ||
Xenial |
New
|
Medium
|
Unassigned | ||
Yakkety |
New
|
Medium
|
Unassigned | ||
linux-lts-quantal (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-lts-raring (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-lts-saucy (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-lts-trusty (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-lts-utopic (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-lts-vivid (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-lts-wily (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Fix Released
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-lts-xenial (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Fix Released
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-mako (Ubuntu) |
New
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
New
|
Medium
|
Unassigned | ||
Xenial |
New
|
Medium
|
Unassigned | ||
Yakkety |
New
|
Medium
|
Unassigned | ||
linux-manta (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
New
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned | ||
linux-raspi2 (Ubuntu) |
Fix Released
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Fix Released
|
Medium
|
Unassigned | ||
Xenial |
Fix Released
|
Medium
|
Unassigned | ||
Yakkety |
Fix Released
|
Medium
|
Unassigned | ||
linux-snapdragon (Ubuntu) |
Fix Released
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Fix Released
|
Medium
|
Unassigned | ||
Yakkety |
Fix Released
|
Medium
|
Unassigned | ||
linux-ti-omap4 (Ubuntu) |
Invalid
|
Medium
|
Unassigned | ||
Precise |
Invalid
|
Medium
|
Unassigned | ||
Trusty |
Invalid
|
Medium
|
Unassigned | ||
Wily |
Invalid
|
Medium
|
Unassigned | ||
Xenial |
Invalid
|
Medium
|
Unassigned | ||
Yakkety |
Invalid
|
Medium
|
Unassigned |
Bug Description
[Impact]
[From https:/
A recent refactoring cof this codepath (https:/
More specifically, the overflow may have been introduced in https:/
+ size_t sz = sizeof(*info) + size;
(where size is an unsigned int passed from userspace).
This issue should only affect 32bit platforms (xt_table_info.size is an unsigned int).
[Fix]
Upstream proposed fix: http://
[Test Case]
Download v4 code from: https:/
gcc *v4.c -o v4
./v4
Your machine should _not_ crash. This only affects 32-bit kernels
Changed in linux (Ubuntu): | |
status: | New → Confirmed |
Changed in linux (Ubuntu Xenial): | |
assignee: | nobody → Tim Gardner (timg-tpi) |
status: | Confirmed → In Progress |
Changed in linux (Ubuntu Wily): | |
assignee: | nobody → Chris J Arges (arges) |
status: | New → In Progress |
Changed in linux (Ubuntu Xenial): | |
status: | In Progress → Fix Committed |
description: | updated |
description: | updated |
Changed in linux (Ubuntu Wily): | |
status: | In Progress → Fix Committed |
tags: | added: kernel-cve-skip-description |
Changed in linux-lts-trusty (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-trusty (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-wily (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-wily (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-quantal (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-quantal (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux (Ubuntu Wily): | |
importance: | Undecided → Medium |
Changed in linux (Ubuntu Xenial): | |
importance: | Undecided → Medium |
Changed in linux-ti-omap4 (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-ti-omap4 (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-raring (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-raring (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-armadaxp (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-armadaxp (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-xenial (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-xenial (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-saucy (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-saucy (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-manta (Ubuntu Wily): | |
importance: | Undecided → Medium |
Changed in linux-manta (Ubuntu Xenial): | |
importance: | Undecided → Medium |
Changed in linux-lts-vivid (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-vivid (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-raspi2 (Ubuntu Wily): | |
importance: | Undecided → Medium |
Changed in linux-raspi2 (Ubuntu Xenial): | |
importance: | Undecided → Medium |
Changed in linux-mako (Ubuntu Wily): | |
importance: | Undecided → Medium |
Changed in linux-mako (Ubuntu Xenial): | |
importance: | Undecided → Medium |
Changed in linux-lts-utopic (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-utopic (Ubuntu Xenial): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-goldfish (Ubuntu Wily): | |
importance: | Undecided → Medium |
Changed in linux-goldfish (Ubuntu Xenial): | |
importance: | Undecided → Medium |
Changed in linux-flo (Ubuntu Wily): | |
importance: | Undecided → Medium |
Changed in linux-flo (Ubuntu Xenial): | |
importance: | Undecided → Medium |
Changed in linux-lts-trusty (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-trusty (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-wily (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-wily (Ubuntu Trusty): | |
status: | New → Fix Released |
importance: | Undecided → Medium |
Changed in linux-lts-quantal (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-quantal (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-ti-omap4 (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-ti-omap4 (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-raring (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-raring (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-armadaxp (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-armadaxp (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-xenial (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-xenial (Ubuntu Trusty): | |
importance: | Undecided → Medium |
Changed in linux-lts-saucy (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-saucy (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-manta (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-manta (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-vivid (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-vivid (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-raspi2 (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-raspi2 (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-mako (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-mako (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-utopic (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-lts-utopic (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-goldfish (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-goldfish (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-flo (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-flo (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-raspi2 (Ubuntu Wily): | |
status: | New → Fix Released |
Changed in linux-manta (Ubuntu Xenial): | |
status: | New → Invalid |
Changed in linux-snapdragon (Ubuntu Precise): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-snapdragon (Ubuntu Wily): | |
status: | New → Invalid |
importance: | Undecided → Medium |
Changed in linux-snapdragon (Ubuntu Xenial): | |
importance: | Undecided → Medium |
Changed in linux-snapdragon (Ubuntu Yakkety): | |
importance: | Undecided → Medium |
Changed in linux-snapdragon (Ubuntu Trusty): | |
status: | New → Invalid |
importance: | Undecided → Medium |
tags: | added: kernel-cve-tracking-bug |
Changed in linux-snapdragon (Ubuntu Xenial): | |
status: | New → Fix Committed |
summary: |
- integer overflow in xt_alloc_table_info + CVE-2016-3135 |
Upstream proposed fix: http:// marc.info/ ?l=netfilter- devel&m= 145757136822750 &w=2