First Last Prev Next    This bug is not in your last search results.
Bug 1023762 - (CVE-2017-5897) VUL-0: CVE-2017-5897: kernel-source: ip6_gre:invalid reads in ip6gre_err()
(CVE-2017-5897)
VUL-0: CVE-2017-5897: kernel-source: ip6_gre:invalid reads in ip6gre_err()
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: unspecified
Assigned To: Security Team bot
Security Team bot
CVSSv2:SUSE:CVE-2017-5897:4.3:(AV:N/...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2017-02-06 12:34 UTC by Mikhail Kasimov
Modified: 2021-08-25 12:44 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mikhail Kasimov 2017-02-06 12:34:34 UTC 
Ref: http://seclists.org/oss-sec/2017/q1/323
==============================================
Hi,

There's a bug in the Linux kernel ipv6 implementation which allows a
remote attacker to trigger an out-of-bounds access.

Upsteam fix:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=7892032cfe67f4bde6fc2ee967e45a8fbaf33756

Could you assign a CVE for this?

Thanks!
==============================================
Comment 2 Swamp Workflow Management 2017-02-06 23:00:44 UTC 
bugbot adjusting priority
Comment 3 Matthias Gerstner 2017-02-07 08:49:07 UTC 
CVE-2017-5897 has been assigned for this issue:

http://seclists.org/oss-sec/2017/q1/327
Comment 4 Michal Kubeček 2017-02-09 07:04:14 UTC 
  introduced              c12b395a4664    v3.7-rc1
  fixed                   7892032cfe67    v4.10

The GRE over IPv6 implementation wasn't backported to any of our pre-3.7
kernel branches.

The fix has been merged or submitted (*) to

  stable                  e1a455d842db
  SLE12-SP2               a1054d11d874 
  openSUSE-42.1           3e7f32e775ac *
  cve/linux-3.12          f957c6115b47 *

I did not submit to master as it's going to get the fix with 4.10 early next
week. On the other hand, getting 4.10 to Tumbleweed or the fix into a 4.9.y
stable update may take some time so I submitted it to stable as well.

Reassigning back to the security team.
Comment 5 Swamp Workflow Management 2017-02-22 20:11:38 UTC 
openSUSE-SU-2017:0541-1: An update that solves four vulnerabilities and has 16 fixes is now available.

Category: security (important)
Bug References: 1012382,1018100,1019168,1020048,1021082,1022181,1022304,1023762,1023884,1023888,1024081,1024234,1024508,1024938,1025235,1026024,969479,982783,989056,998106
CVE References: CVE-2017-5897,CVE-2017-5970,CVE-2017-5986,CVE-2017-6074
Sources used:
openSUSE Leap 42.2 (src):    kernel-debug-4.4.49-16.1, kernel-default-4.4.49-16.1, kernel-docs-4.4.49-16.2, kernel-obs-build-4.4.49-16.1, kernel-obs-qa-4.4.49-16.1, kernel-source-4.4.49-16.1, kernel-syms-4.4.49-16.1, kernel-vanilla-4.4.49-16.1
Comment 6 Swamp Workflow Management 2017-02-22 20:16:36 UTC 
openSUSE-SU-2017:0547-1: An update that solves four vulnerabilities and has 86 fixes is now available.

Category: security (important)
Bug References: 1005666,1015787,1018100,1023762,1023888,1024081,1024234,1024508,1024938,1025047,1025048,1025049,1025050,1025051,1025053,1025055,1025057,1025058,1025059,1025060,1025061,1025062,1025063,1025064,1025065,1025066,1025067,1025069,1025070,1025071,1025072,1025073,1025074,1025075,1025076,1025077,1025079,1025080,1025081,1025235,1026024,865869,904489,927455,929871,935087,935088,936445,937609,937612,937616,938550,938891,938892,942512,942685,942925,944001,945649,946057,946902,949440,949472,951615,951844,957805,960300,963193,965344,966278,966910,968230,972844,972951,972993,973855,975596,977685,981038,981709,983087,984779,985562,985850,987192,989953,990384,992712,993841,994881
CVE References: CVE-2017-5897,CVE-2017-5970,CVE-2017-5986,CVE-2017-6074
Sources used:
openSUSE Leap 42.1 (src):    kernel-debug-4.1.38-50.1, kernel-default-4.1.38-50.1, kernel-docs-4.1.38-50.3, kernel-ec2-4.1.38-50.1, kernel-obs-build-4.1.38-50.2, kernel-obs-qa-4.1.38-50.1, kernel-pae-4.1.38-50.1, kernel-pv-4.1.38-50.1, kernel-source-4.1.38-50.1, kernel-syms-4.1.38-50.1, kernel-vanilla-4.1.38-50.1, kernel-xen-4.1.38-50.1
Comment 7 Swamp Workflow Management 2017-02-28 23:24:03 UTC 
SUSE-SU-2017:0575-1: An update that solves 11 vulnerabilities and has 95 fixes is now available.

Category: security (important)
Bug References: 1000092,1000619,1003077,1005918,1006469,1006472,1007729,1008742,1009546,1009674,1009718,1009911,1010612,1010690,1010933,1011176,1011602,1011660,1011913,1012382,1012422,1012829,1012910,1013000,1013001,1013273,1013540,1013792,1013994,1014120,1014410,1015038,1015367,1015840,1016250,1016403,1016517,1016884,1016979,1017164,1017170,1017410,1018100,1018316,1018358,1018446,1018813,1018913,1019061,1019148,1019168,1019260,1019351,1019594,1019630,1019631,1019784,1019851,1020048,1020214,1020488,1020602,1020685,1020817,1020945,1020975,1021082,1021248,1021251,1021258,1021260,1021294,1021455,1021474,1022304,1022429,1022476,1022547,1022559,1022971,1023101,1023175,1023762,1023884,1023888,1024081,1024234,1024508,1024938,1025235,921494,959709,964944,969476,969477,969479,971975,974215,981709,982783,985561,987192,987576,989056,991273,998106
CVE References: CVE-2015-8709,CVE-2016-7117,CVE-2016-9806,CVE-2017-2583,CVE-2017-2584,CVE-2017-5551,CVE-2017-5576,CVE-2017-5577,CVE-2017-5897,CVE-2017-5970,CVE-2017-5986
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    kernel-default-4.4.49-92.11.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    kernel-docs-4.4.49-92.11.3, kernel-obs-build-4.4.49-92.11.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    kernel-default-4.4.49-92.11.1, kernel-source-4.4.49-92.11.1, kernel-syms-4.4.49-92.11.1
SUSE Linux Enterprise Server 12-SP2 (src):    kernel-default-4.4.49-92.11.1, kernel-source-4.4.49-92.11.1, kernel-syms-4.4.49-92.11.1
SUSE Linux Enterprise Live Patching 12 (src):    kgraft-patch-SLE12-SP2_Update_5-1-6.1
SUSE Linux Enterprise High Availability 12-SP2 (src):    kernel-default-4.4.49-92.11.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    kernel-default-4.4.49-92.11.1, kernel-source-4.4.49-92.11.1, kernel-syms-4.4.49-92.11.1
OpenStack Cloud Magnum Orchestration 7 (src):    kernel-default-4.4.49-92.11.1
Comment 8 Swamp Workflow Management 2017-05-11 19:10:15 UTC 
SUSE-SU-2017:1247-1: An update that solves 25 vulnerabilities and has 10 fixes is now available.

Category: security (important)
Bug References: 1003077,1015703,1021256,1021762,1023377,1023762,1023992,1024938,1025235,1026024,1026722,1026914,1027066,1027149,1027178,1027189,1027190,1028415,1028895,1029986,1030118,1030213,1030901,1031003,1031052,1031440,1031579,1032344,1033336,914939,954763,968697,979215,983212,989056
CVE References: CVE-2015-1350,CVE-2016-10044,CVE-2016-10200,CVE-2016-10208,CVE-2016-2117,CVE-2016-3070,CVE-2016-5243,CVE-2016-7117,CVE-2016-9588,CVE-2017-2671,CVE-2017-5669,CVE-2017-5897,CVE-2017-5970,CVE-2017-5986,CVE-2017-6074,CVE-2017-6214,CVE-2017-6345,CVE-2017-6346,CVE-2017-6348,CVE-2017-6353,CVE-2017-7187,CVE-2017-7261,CVE-2017-7294,CVE-2017-7308,CVE-2017-7616
Sources used:
SUSE Linux Enterprise Server for SAP 12 (src):    kernel-default-3.12.61-52.72.1, kernel-source-3.12.61-52.72.1, kernel-syms-3.12.61-52.72.1, kernel-xen-3.12.61-52.72.1, kgraft-patch-SLE12_Update_21-1-2.1
SUSE Linux Enterprise Server 12-LTSS (src):    kernel-default-3.12.61-52.72.1, kernel-source-3.12.61-52.72.1, kernel-syms-3.12.61-52.72.1, kernel-xen-3.12.61-52.72.1, kgraft-patch-SLE12_Update_21-1-2.1
SUSE Linux Enterprise Module for Public Cloud 12 (src):    kernel-ec2-3.12.61-52.72.1
Comment 9 Swamp Workflow Management 2017-05-19 16:15:23 UTC 
SUSE-SU-2017:1360-1: An update that solves 30 vulnerabilities and has 72 fixes is now available.

Category: security (important)
Bug References: 1003077,1008842,1009682,1012620,1012985,1015703,1015787,1015821,1017512,1018100,1018263,1018419,1018446,1019168,1019514,1020048,1020795,1021256,1021374,1021762,1021913,1022559,1022971,1023164,1023207,1023377,1023762,1023824,1023888,1023992,1024081,1024234,1024309,1024508,1024788,1025039,1025235,1025354,1025802,1026024,1026722,1026914,1027066,1027178,1027189,1027190,1027974,1028041,1028415,1028595,1028648,1028895,1029470,1029850,1029986,1030118,1030213,1030593,1030901,1031003,1031052,1031080,1031440,1031567,1031579,1031662,1031842,1032125,1032141,1032344,1032345,1033336,1034670,103470,1034700,1035576,1035699,1035738,1035877,1036752,1038261,799133,857926,914939,917630,922853,930399,931620,937444,940946,954763,968697,970083,971933,979215,982783,983212,984530,985561,988065,989056,993832
CVE References: CVE-2015-1350,CVE-2016-10044,CVE-2016-10200,CVE-2016-10208,CVE-2016-2117,CVE-2016-3070,CVE-2016-5243,CVE-2016-7117,CVE-2016-9191,CVE-2016-9588,CVE-2016-9604,CVE-2017-2647,CVE-2017-2671,CVE-2017-5669,CVE-2017-5897,CVE-2017-5986,CVE-2017-6074,CVE-2017-6214,CVE-2017-6345,CVE-2017-6346,CVE-2017-6348,CVE-2017-6353,CVE-2017-6951,CVE-2017-7187,CVE-2017-7261,CVE-2017-7294,CVE-2017-7308,CVE-2017-7616,CVE-2017-7645,CVE-2017-8106
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP1 (src):    kernel-default-3.12.74-60.64.40.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    kernel-docs-3.12.74-60.64.40.4, kernel-obs-build-3.12.74-60.64.40.1
SUSE Linux Enterprise Server 12-SP1 (src):    kernel-default-3.12.74-60.64.40.1, kernel-source-3.12.74-60.64.40.1, kernel-syms-3.12.74-60.64.40.1, kernel-xen-3.12.74-60.64.40.1
SUSE Linux Enterprise Module for Public Cloud 12 (src):    kernel-ec2-3.12.74-60.64.40.1
SUSE Linux Enterprise Live Patching 12 (src):    kgraft-patch-SLE12-SP1_Update_15-1-4.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    kernel-default-3.12.74-60.64.40.1, kernel-source-3.12.74-60.64.40.1, kernel-syms-3.12.74-60.64.40.1, kernel-xen-3.12.74-60.64.40.1
Comment 10 Marcus Meissner 2017-06-23 09:03:16 UTC 
released
Comment 11 Swamp Workflow Management 2017-07-28 13:27:56 UTC 
SUSE-SU-2017:1990-1: An update that solves 43 vulnerabilities and has 282 fixes is now available.

Category: security (important)
Bug References: 1000092,1003077,1003581,1004003,1007729,1007959,1007962,1008842,1009674,1009718,1010032,1010612,1010690,1011044,1011176,1011913,1012060,1012382,1012422,1012452,1012829,1012910,1012985,1013001,1013561,1013792,1013887,1013994,1014120,1014136,1015342,1015367,1015452,1015609,1016403,1017164,1017170,1017410,1017461,1017641,1018100,1018263,1018358,1018385,1018419,1018446,1018813,1018885,1018913,1019061,1019148,1019163,1019168,1019260,1019351,1019594,1019614,1019618,1019630,1019631,1019784,1019851,1020048,1020214,1020412,1020488,1020602,1020685,1020817,1020945,1020975,1021082,1021248,1021251,1021258,1021260,1021294,1021424,1021455,1021474,1021762,1022181,1022266,1022304,1022340,1022429,1022476,1022547,1022559,1022595,1022785,1022971,1023101,1023175,1023287,1023762,1023866,1023884,1023888,1024015,1024081,1024234,1024508,1024938,1025039,1025235,1025461,1025683,1026024,1026405,1026462,1026505,1026509,1026570,1026692,1026722,1027054,1027066,1027101,1027153,1027179,1027189,1027190,1027195,1027273,1027512,1027565,1027616,1027974,1028017,1028027,1028041,1028158,1028217,1028310,1028325,1028340,1028372,1028415,1028819,1028883,1028895,1029220,1029514,1029607,1029634,1029986,1030057,1030070,1030118,1030213,1030573,1031003,1031040,1031052,1031142,1031147,1031200,1031206,1031208,1031440,1031470,1031500,1031512,1031555,1031579,1031662,1031717,1031796,1031831,1032006,1032141,1032339,1032345,1032400,1032581,1032673,1032681,1032803,1033117,1033281,1033287,1033336,1033340,1033885,1034048,1034419,1034635,1034670,1034671,1034762,1034902,1034995,1035024,1035866,1035887,1035920,1035922,1036214,1036638,1036752,1036763,1037177,1037186,1037384,1037483,1037669,1037840,1037871,1037969,1038033,1038043,1038085,1038142,1038143,1038297,1038458,1038544,1038842,1038843,1038846,1038847,1038848,1038879,1038981,1038982,1039348,1039354,1039700,1039864,1039882,1039883,1039885,1039900,1040069,1040125,1040182,1040279,1040351,1040364,1040395,1040425,1040463,1040567,1040609,1040855,1040929,1040941,1041087,1041160,1041168,1041242,1041431,1041810,1042200,1042286,1042356,1042421,1042517,1042535,1042536,1042863,1042886,1043014,1043231,1043236,1043347,1043371,1043467,1043488,1043598,1043912,1043935,1043990,1044015,1044082,1044120,1044125,1044532,1044767,1044772,1044854,1044880,1044912,1045154,1045235,1045286,1045307,1045340,1045467,1045568,1046105,1046434,1046589,799133,863764,870618,922871,951844,966170,966172,966191,966321,966339,968697,969479,969755,970083,971975,982783,985561,986362,986365,987192,987576,988065,989056,989311,990058,990682,991273,993832,995542,995968,998106
CVE References: CVE-2016-10200,CVE-2016-2117,CVE-2016-4997,CVE-2016-4998,CVE-2016-7117,CVE-2016-9191,CVE-2017-1000364,CVE-2017-1000365,CVE-2017-1000380,CVE-2017-2583,CVE-2017-2584,CVE-2017-2596,CVE-2017-2636,CVE-2017-2671,CVE-2017-5551,CVE-2017-5576,CVE-2017-5577,CVE-2017-5897,CVE-2017-5970,CVE-2017-5986,CVE-2017-6074,CVE-2017-6214,CVE-2017-6345,CVE-2017-6346,CVE-2017-6347,CVE-2017-6353,CVE-2017-7184,CVE-2017-7187,CVE-2017-7261,CVE-2017-7294,CVE-2017-7308,CVE-2017-7346,CVE-2017-7374,CVE-2017-7487,CVE-2017-7616,CVE-2017-7618,CVE-2017-8890,CVE-2017-9074,CVE-2017-9075,CVE-2017-9076,CVE-2017-9077,CVE-2017-9150,CVE-2017-9242
Sources used:
SUSE Linux Enterprise Real Time Extension 12-SP2 (src):    kernel-rt-4.4.74-7.10.1, kernel-rt_debug-4.4.74-7.10.1, kernel-source-rt-4.4.74-7.10.1, kernel-syms-rt-4.4.74-7.10.1
First Last Prev Next    This bug is not in your last search results.