Date: Tue, 17 May 2016 11:01:17 +1000 From: Wade Mealing <wmealing@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE-2016-3707 : kernel-rt - Sending SysRq command via ICMP echo request Gday, A flaw was found in the kernel-rt in which an attacker could submit a specially crafted ICMP echo request which can trigger a sysrq function based on values in the ICMP packet. This feature was introduced in the kernel-rt only and is not shipping with standard Red Hat Enterprise Linux kernels. Other kernels also ship this patch. When enabled, remote attacker who are able to send ICMP packets to the host could exploit this feature using bruteforce to submit arbitrary SysRq commands. A local user can find the cookie immediately by inspecting the cookie file: $ ls -l /proc/sys/net/ipv4/icmp_echo_sysrq -rw-r--r--. 1 root root 0 Apr 28 15:39 /proc/sys/net/ipv4/icmp_echo_sysrq This pattern in hex can be used to attack the host with the icmp_echo_sysrq cookie set (and sysrq enabled) as per this example: # ping -c1 -s57 -p0102030468 <target> Remote attacker could exploit this feature using bruteforce to submit arbitrary SysRq commands if this feature was enabled. There is no fix for this at the time, this feature can be disabled / reverted in the code and usual methods of sysrq magic keys can be used as a workaround till a sufficient alternative has been developed. Resources: https://www.kernel.org/pub/linux/kernel/projects/rt/4.4/patch-4.4.7-rt16.patch.gz Upstream discussion on original topic: https://lwn.net/Articles/448790/ Red Hat Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-3707
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ