Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 17 May 2016 11:01:17 +1000
From: Wade Mealing <>
Subject: CVE-2016-3707 : kernel-rt - Sending SysRq command via ICMP echo request


A flaw was found in the kernel-rt in which an attacker could submit a
specially crafted ICMP echo request which can trigger a sysrq function
based on values in the ICMP packet.

This feature was introduced in the kernel-rt only and is not shipping
with standard Red Hat Enterprise Linux kernels.  Other kernels also
ship this patch.

When enabled, remote attacker who are able to send ICMP packets to the
host could exploit this feature using bruteforce to submit arbitrary
SysRq commands.

A local user can find the cookie immediately by inspecting the cookie file:

$ ls -l /proc/sys/net/ipv4/icmp_echo_sysrq
-rw-r--r--. 1 root root 0 Apr 28 15:39 /proc/sys/net/ipv4/icmp_echo_sysrq

This pattern in hex can be used to attack the host with the
icmp_echo_sysrq cookie set (and sysrq enabled) as per this example:

# ping -c1 -s57 -p0102030468 <target>

Remote attacker could exploit this feature using bruteforce to submit
arbitrary SysRq commands if this feature was enabled.

There is no fix for this at the time, this feature can be disabled /
reverted in the code and usual methods of sysrq magic keys can be used
as a workaround till a sufficient alternative has been developed.


Upstream discussion on original topic:

Red Hat Bugzilla:

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.