Udp.c in Linux kernel pre-4.5 allows remote attackers to execute arbitrary code

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by bipson on Thursday April 13, 2017 @07:23AM (#14105872)

It seems [1] recent kernels are not affected by this. So if you are running older (hopefully lts kernels), you might need to verify them, otherwise you should be fine (check back with your distro obviously).

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by user5994461 on Thursday April 13, 2017 @07:35AM (#14105926)

Correction: ALL production OS and kernels are affected.

"udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]"

There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by vbernat on Thursday April 13, 2017 @08:19AM (#14106141)

This doesn't seem true from the commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

The bug is said to not be exploitable since Al Viro function change. This change happened in 3.19.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by mhei on Thursday April 13, 2017 @09:48AM (#14106833)

The problematic patch only seems to be introduced in mainline 4.2, not 3.19, compare:

http://lxr.free-electrons.com/source/net/core/datagram.c?v=3...

http://lxr.free-electrons.com/source/net/core/datagram.c?v=4...

I am just trying to completely understand the bug, I wonder if it really was unexploitable before the patch. Got any source for that?

EDIT: sorry, misunderstood your message / mixed up commits, I was looking into when 89c22d8c3b27 hit mainline, which causes the vulnerable code path.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by vbernat on Thursday April 13, 2017 @11:01AM (#14107521)

Why "problematic"? The Al Viro change mentioned in the fix is https://github.com/torvalds/linux/commit/227158db160449b6513.... The commit says this makes the bug not exploitable since the new helper function handles correctly the edge case. The fix still needs to be applied to avoid computing the checksum twice.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by trebla on Thursday April 13, 2017 @09:02AM (#14106424)

Is it confirmed that kernels before 3.19 are safe?

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by Ndymium on Thursday April 13, 2017 @07:50AM (#14105995)

Huh? I'm running Arch Linux on kernel 4.8 (latest in repos is 4.10). Ubuntu 16.10 has kernel 4.8.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by pmontra on Thursday April 13, 2017 @08:19AM (#14106140)

Servers are usually on LTS versions. Ubuntu 16.04 is on 4.4 last time I checked. My Android 7.0 phone is on 3.10.84, last updated in February.

Edit: Ubuntu's tracker is at https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by jbbarth on Thursday April 13, 2017 @08:22AM (#14106161)

Patches from upstream are regularly backported by distribution vendors, including Redhat, Debian, Ubuntu (though I don't know if Ubuntu do this themselves or base on Debian). Anyway, looking at the version number is not enough, you should refer your vendor security advisories.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by kasabali on Thursday April 13, 2017 @08:11PM (#14111805)

> Correction: ALL production OS and kernels are affected.

No, ALL production OS backport security patches to their kernels. This bug was fixed in Debian 15 months ago and Debian stable kernel is way older than 4.5.

> "udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]" > There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).

Kernel version is meaningless, see above.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by pdexter on Thursday April 13, 2017 @07:51AM (#14106003)

Arch is on 4.10.9

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by BozeWolf on Thursday April 13, 2017 @07:53AM (#14106009)

Yes but arch is not a serious production/server os. Although some of you may do it.

Most servers/business run on (not the latest) redhat/suse/debian/ubuntu and derivates. They dont have kernel versions that recent.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by belovedeagle on Thursday April 13, 2017 @04:19PM (#14110585)

That just goes to show that Ubuntu and friends are not serious production OS. In what world is extended vulnerability to months-old bugs a legitimate prerequisite for production viability?

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by merb on Thursday April 13, 2017 @07:35AM (#14105924)

which is not really cool I mean I at least need to check two kernels:

- Linux git 4.4.0-72-generic #93-Ubuntu SMP Fri Mar 31 14:07:41 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux (Ubuntu 16.04, but I can probably switch to HWE) - Linux censored 3.10.0-514.6.1.el7.x86_64 #1 SMP Wed Jan 18 13:06:36 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux (CentOS 7.3.1611)

not really cool :/

happily I have no udp traffic and the AWS/internal firewall blocks all udp traffic by default.

[ Parent | on HN ]

Re:Udp.c in Linux kernel pre-4.5 allows remote attackers to ... by lathiat on Thursday April 13, 2017 @08:39AM (#14106270)

https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...

Apparently xenial 4.4 is not affected.

[ Parent | on HN ]