First Last Prev Next    This bug is not in your last search results.
Bug 1083650 - (CVE-2018-1065) VUL-0: CVE-2018-1065 kernel: xtables NULL pointer dereference in ip6_tables.c:ip6t_do_table() leading to a crash
(CVE-2018-1065)
VUL-0: CVE-2018-1065 kernel: xtables NULL pointer dereference in ip6_tables.c...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/201087/
CVSSv3:SUSE:CVE-2018-1065:5.9:(AV:N/...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2018-03-02 09:26 UTC by Karol Babioch
Modified: 2020-06-16 13:57 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Karol Babioch 2018-03-02 09:26:07 UTC 
rh#1547824

The Linux kernel at version 4.15.0-rc9 is vulnerable to a NULL pointer dereference ip6_tables.c:ip6t_do_table() leading to a crash. This vulnerability is only present under certain malformed iptables rulesets.

Inserting malformed rules its a privileged operation as root or a user with CAP_NET_RAW,CAP_NET_ADMIN capabilities ( see man setcap(8) ).

As this requires advanced privileges Red Hat Product Security has rated this flaw as moderate.

Additional References:

Netdev list:
http://lists.openwall.net/netdev/2018/01/27/46

Upstream patch:
http://patchwork.ozlabs.org/patch/870355/

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1547824
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1065
Comment 1 Michal Kubeček 2018-03-02 13:29:23 UTC 
In mainline (since v4.16-rc3) as

  57ebd808a97d  netfilter: add back stackpointer size checks

SLE15 already has the fix (thanks to git-fixes), I'll add the references there.

The offending commit came in v4.3-rc1 and hasn't been backported into older
SLE/openSUSE kernels so that only SLE12-SP2, SLE12-SP3 and stable will need
a backport.
Comment 2 Michal Kubeček 2018-05-16 11:02:26 UTC 
The fix is now present in all affected branches:

  stable                  4.16
  SLE15                   f30df127cff3
  SLE12-SP3               4.4.122 
  SLE12-SP2-LTSS          bf23bebafb0b

Reassigning back to security team.
Comment 3 Swamp Workflow Management 2018-05-23 05:57:34 UTC 
SUSE-SU-2018:1366-1: An update that solves 9 vulnerabilities and has 71 fixes is now available.

Category: security (important)
Bug References: 1005778,1005780,1005781,1009062,1012382,1015336,1015337,1015340,1015342,1015343,1022604,1022743,1024296,1031492,1036215,1043598,1044596,1056415,1056427,1060799,1068032,1075087,1075091,1075994,1076263,1080157,1082153,1082299,1082485,1082962,1083125,1083635,1083650,1083900,1084721,1085058,1085185,1085511,1085958,1087082,1088242,1088865,1089023,1089115,1089198,1089393,1089608,1089644,1089752,1089895,1089925,1090225,1090643,1090658,1090663,1090708,1090718,1090734,1090953,1091041,1091325,1091728,1091925,1091960,1092289,1092497,1092566,1092904,1093008,1093144,1093215,1094019,802154,966170,966172,966186,966191,969476,969477,981348
CVE References: CVE-2018-1000199,CVE-2018-10087,CVE-2018-10124,CVE-2018-1065,CVE-2018-1130,CVE-2018-3639,CVE-2018-5803,CVE-2018-7492,CVE-2018-8781
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    kernel-default-4.4.131-94.29.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    kernel-docs-4.4.131-94.29.1, kernel-obs-build-4.4.131-94.29.1
SUSE Linux Enterprise Server 12-SP3 (src):    kernel-default-4.4.131-94.29.1, kernel-source-4.4.131-94.29.1, kernel-syms-4.4.131-94.29.1
SUSE Linux Enterprise Live Patching 12-SP3 (src):    kgraft-patch-SLE12-SP3_Update_12-1-4.5.2
SUSE Linux Enterprise High Availability 12-SP3 (src):    kernel-default-4.4.131-94.29.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    kernel-default-4.4.131-94.29.1, kernel-source-4.4.131-94.29.1, kernel-syms-4.4.131-94.29.1
SUSE CaaS Platform ALL (src):    kernel-default-4.4.131-94.29.1
Comment 4 Swamp Workflow Management 2018-05-24 19:15:37 UTC 
openSUSE-SU-2018:1418-1: An update that solves 11 vulnerabilities and has 93 fixes is now available.

Category: security (important)
Bug References: 1005778,1005780,1005781,1009062,1012382,1015336,1015337,1015340,1015342,1015343,1022604,1022743,1024296,1031492,1036215,1043598,1044596,1056415,1056427,1060799,1066223,1068032,1070404,1073059,1075087,1075091,1075994,1076263,1076805,1080157,1081599,1082153,1082299,1082485,1082962,1083125,1083635,1083650,1083900,1084610,1084699,1084721,1085058,1085185,1085511,1085679,1085958,1086162,1087082,1087274,1088050,1088242,1088267,1088313,1088600,1088684,1088810,1088865,1088871,1089023,1089115,1089198,1089393,1089608,1089644,1089752,1089895,1089925,1090225,1090643,1090658,1090663,1090708,1090718,1090734,1090953,1091041,1091325,1091728,1091960,1092289,1092497,1092566,1092772,1092888,1092904,1092975,1093008,1093035,1093144,1093215,1093990,1094019,1094033,1094059,802154,966170,966172,966186,966191,969476,969477,981348,993388
CVE References: CVE-2017-18257,CVE-2018-1000199,CVE-2018-10087,CVE-2018-10124,CVE-2018-1065,CVE-2018-1130,CVE-2018-3639,CVE-2018-5803,CVE-2018-7492,CVE-2018-8781,CVE-2018-8822
Sources used:
openSUSE Leap 42.3 (src):    kernel-debug-4.4.132-53.1, kernel-default-4.4.132-53.1, kernel-docs-4.4.132-53.1, kernel-obs-build-4.4.132-53.1, kernel-obs-qa-4.4.132-53.1, kernel-source-4.4.132-53.1, kernel-syms-4.4.132-53.1, kernel-vanilla-4.4.132-53.1
Comment 6 Swamp Workflow Management 2018-06-26 16:17:49 UTC 
SUSE-SU-2018:1816-1: An update that solves 17 vulnerabilities and has 109 fixes is now available.

Category: security (important)
Bug References: 1009062,1012382,1019695,1019699,1022604,1022607,1022743,1024718,1031717,1035432,1036215,1041740,1043598,1044596,1045330,1056415,1056427,1060799,1066223,1068032,1068054,1068951,1070404,1073059,1073311,1075087,1075428,1076049,1076263,1076805,1078583,1079152,1080157,1080542,1080656,1081500,1081514,1081599,1082153,1082299,1082485,1082504,1082962,1082979,1083635,1083650,1083900,1084721,1085185,1085308,1086400,1086716,1087007,1087012,1087036,1087082,1087086,1087095,1088810,1088871,1089023,1089115,1089393,1089895,1090225,1090435,1090534,1090643,1090658,1090663,1090708,1090718,1090734,1090953,1090955,1091041,1091325,1091594,1091728,1091960,1092289,1092497,1092552,1092566,1092772,1092813,1092888,1092904,1092975,1093008,1093035,1093144,1093215,1093533,1093904,1093990,1094019,1094033,1094059,1094177,1094268,1094353,1094356,1094405,1094466,1094532,1094823,1094840,1095042,1095147,1096037,1096140,1096214,1096242,1096281,1096751,1096982,1097234,1097356,1098009,1098012,919144,971975,973378,978907,993388
CVE References: CVE-2017-13305,CVE-2017-17741,CVE-2017-18241,CVE-2017-18249,CVE-2018-1000199,CVE-2018-1065,CVE-2018-1092,CVE-2018-1093,CVE-2018-1094,CVE-2018-1130,CVE-2018-12233,CVE-2018-3639,CVE-2018-3665,CVE-2018-5803,CVE-2018-5848,CVE-2018-7492,CVE-2018-8781
Sources used:
SUSE Linux Enterprise Real Time Extension 12-SP3 (src):    kernel-rt-4.4.138-3.14.1, kernel-rt_debug-4.4.138-3.14.1, kernel-source-rt-4.4.138-3.14.1, kernel-syms-rt-4.4.138-3.14.1
Comment 7 Swamp Workflow Management 2018-06-29 19:16:45 UTC 
SUSE-SU-2018:1855-1: An update that solves 14 vulnerabilities and has 15 fixes is now available.

Category: security (important)
Bug References: 1068032,1079152,1082962,1083650,1083900,1085185,1086400,1087007,1087012,1087036,1087086,1087095,1089895,1090534,1090955,1092497,1092552,1092813,1092904,1094033,1094353,1094823,1095042,1096140,1096242,1096281,1096728,1097356,973378
CVE References: CVE-2017-13305,CVE-2017-18241,CVE-2017-18249,CVE-2018-1000199,CVE-2018-1000204,CVE-2018-1065,CVE-2018-1092,CVE-2018-1093,CVE-2018-1094,CVE-2018-1130,CVE-2018-3665,CVE-2018-5803,CVE-2018-5848,CVE-2018-7492
Sources used:
SUSE OpenStack Cloud 7 (src):    kernel-default-4.4.121-92.85.1, kernel-source-4.4.121-92.85.1, kernel-syms-4.4.121-92.85.1, kgraft-patch-SLE12-SP2_Update_23-1-3.5.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    kernel-default-4.4.121-92.85.1, kernel-source-4.4.121-92.85.1, kernel-syms-4.4.121-92.85.1, kgraft-patch-SLE12-SP2_Update_23-1-3.5.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    kernel-default-4.4.121-92.85.1, kernel-source-4.4.121-92.85.1, kernel-syms-4.4.121-92.85.1, kgraft-patch-SLE12-SP2_Update_23-1-3.5.1
SUSE Enterprise Storage 4 (src):    kernel-default-4.4.121-92.85.1, kernel-source-4.4.121-92.85.1, kernel-syms-4.4.121-92.85.1, kgraft-patch-SLE12-SP2_Update_23-1-3.5.1
OpenStack Cloud Magnum Orchestration 7 (src):    kernel-default-4.4.121-92.85.1
Comment 11 Marcus Meissner 2018-09-07 12:39:24 UTC 
done
Comment 12 Swamp Workflow Management 2018-10-18 16:45:17 UTC 
SUSE-SU-2018:1855-2: An update that solves 14 vulnerabilities and has 15 fixes is now available.

Category: security (important)
Bug References: 1068032,1079152,1082962,1083650,1083900,1085185,1086400,1087007,1087012,1087036,1087086,1087095,1089895,1090534,1090955,1092497,1092552,1092813,1092904,1094033,1094353,1094823,1095042,1096140,1096242,1096281,1096728,1097356,973378
CVE References: CVE-2017-13305,CVE-2017-18241,CVE-2017-18249,CVE-2018-1000199,CVE-2018-1000204,CVE-2018-1065,CVE-2018-1092,CVE-2018-1093,CVE-2018-1094,CVE-2018-1130,CVE-2018-3665,CVE-2018-5803,CVE-2018-5848,CVE-2018-7492
Sources used:
SUSE Linux Enterprise Server 12-SP2-BCL (src):    kernel-default-4.4.121-92.85.1, kernel-source-4.4.121-92.85.1, kernel-syms-4.4.121-92.85.1, kgraft-patch-SLE12-SP2_Update_23-1-3.5.1
First Last Prev Next    This bug is not in your last search results.