CVE-2016-3135

Published: 10 March 2016

Integer overflow in the xt_alloc_table_info function in net/netfilter/x_tables.c in the Linux kernel through 4.5.2 on 32-bit platforms allows local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call.

From the Ubuntu Security Team

Ben Hawkes discovered an integer overflow in the Linux netfilter implementation. On systems running 32 bit kernels, a local unprivileged attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

possibly introduced with 711bdde6a884354ddae8da2fcb495b2a9364cc90
affects 4.2 and newer

Status

Severity score breakdown

References

• https://code.google.com/p/google-security-research/issues/detail?id=758
• http://marc.info/?l=netfilter-devel&m=145757136822750&w=2 (proposed fix)
• http://www.openwall.com/lists/oss-security/2016/03/14/1
• https://ubuntu.com/security/notices/USN-2930-1
• https://ubuntu.com/security/notices/USN-2930-2
• https://ubuntu.com/security/notices/USN-2930-3
• https://ubuntu.com/security/notices/USN-3054-1
• https://ubuntu.com/security/notices/USN-3055-1
• https://ubuntu.com/security/notices/USN-3056-1
• https://ubuntu.com/security/notices/USN-3057-1
• https://www.cve.org/CVERecord?id=CVE-2016-3135
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1555353