CVE-2017-16995

Published: 27 December 2017

The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging incorrect sign extension.

From the Ubuntu Security Team

Jann Horn discovered that the Berkeley Packet Filter (BPF) implementation in the Linux kernel improperly performed sign extension in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

Mitigation for this vulnerability is available by setting the
kernel.unprivileged_bpf_disabled sysctl to 1:
$ sudo sysctl kernel.unprivileged_bpf_disabled=1
$ echo kernel.unprivileged_bpf_disabled=1 | \
sudo tee /etc/sysctl.d/90-CVE-2017-16995-CVE-2017-16996.conf

Current breaks sha1 (taken from the fix patch) only makes 4.14+
affected. However upstream stable backported a fix for it. So I
will modify the breaks sha1 to point to when the surrounding code
was added.

Status

Severity score breakdown

References

• http://openwall.com/lists/oss-security/2017/12/21/2
• https://ubuntu.com/security/notices/USN-3523-1
• https://ubuntu.com/security/notices/USN-3523-2
• https://ubuntu.com/security/notices/USN-3523-3
• https://ubuntu.com/security/notices/USN-3619-1
• https://ubuntu.com/security/notices/USN-3619-2
• https://ubuntu.com/security/notices/USN-3633-1
• https://www.cve.org/CVERecord?id=CVE-2017-16995
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1454