CVE-2016-4997

Published: 24 June 2016

The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.

From the Ubuntu security team

Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility IPT_SO_SET_REPLACE events on 64 bit platforms. A local unprivileged attacker could use this to cause a denial of service (system crash) or execute arbitrary code with administrative privileges.

Priority

High

CVSS 3 base score: 7.8

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

priority is negligible on precise's 3.2 kernels, as user
namespaces are a privileged operation there.
For xenial and linux-lts-xenial on trusty, this can be
mitigated against by setting the kernel.unprivileged_userns_clone
sysctl to 0 to disable userns support. When we fix the netfilter issue
we will also add this sysctl to all other supported kernels to allow
disabling unprivileged user namespaces. Disabling user namespace may
impact chromium-browser, lxc, lxd, docker, and other tools.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4997
• https://marc.info/?l=oss-security&m=146679591706851&w=2
• https://ubuntu.com/security/notices/USN-3016-1
• https://ubuntu.com/security/notices/USN-3016-2
• https://ubuntu.com/security/notices/USN-3017-1
• https://ubuntu.com/security/notices/USN-3017-3
• https://ubuntu.com/security/notices/USN-3016-3
• https://ubuntu.com/security/notices/USN-3016-4
• https://ubuntu.com/security/notices/USN-3017-2
• https://ubuntu.com/security/notices/USN-3020-1
• https://ubuntu.com/security/notices/USN-3018-2
• https://ubuntu.com/security/notices/USN-3018-1
• https://ubuntu.com/security/notices/USN-3019-1
• https://ubuntu.com/security/notices/USN-3338-1
• NVD
• Launchpad
• Debian

Bugs