Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 17 May 2016 11:01:17 +1000
From: Wade Mealing <wmealing@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2016-3707 : kernel-rt - Sending SysRq command via ICMP echo request

Gday,

A flaw was found in the kernel-rt in which an attacker could submit a
specially crafted ICMP echo request which can trigger a sysrq function
based on values in the ICMP packet.

This feature was introduced in the kernel-rt only and is not shipping
with standard Red Hat Enterprise Linux kernels.  Other kernels also
ship this patch.

When enabled, remote attacker who are able to send ICMP packets to the
host could exploit this feature using bruteforce to submit arbitrary
SysRq commands.

A local user can find the cookie immediately by inspecting the cookie file:

$ ls -l /proc/sys/net/ipv4/icmp_echo_sysrq
-rw-r--r--. 1 root root 0 Apr 28 15:39 /proc/sys/net/ipv4/icmp_echo_sysrq

This pattern in hex can be used to attack the host with the
icmp_echo_sysrq cookie set (and sysrq enabled) as per this example:

# ping -c1 -s57 -p0102030468 <target>

Remote attacker could exploit this feature using bruteforce to submit
arbitrary SysRq commands if this feature was enabled.

There is no fix for this at the time, this feature can be disabled /
reverted in the code and usual methods of sysrq magic keys can be used
as a workaround till a sufficient alternative has been developed.

Resources:
https://www.kernel.org/pub/linux/kernel/projects/rt/4.4/patch-4.4.7-rt16.patch.gz

Upstream discussion on original topic:
https://lwn.net/Articles/448790/

Red Hat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-3707

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ