Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CALJHwhRq0gS+0H-iFUm9kr2kDGoGXa01=ZakM=FwraBdAZoSCQ@mail.gmail.com>
Date: Tue, 15 Nov 2016 12:25:35 +1000
From: Wade Mealing <wmealing@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2016-8646: linux kernel - oops in shash_async_export()

Gday,

Igor Redko from Virtuozzo found a vulnerability was found in the Linux
kernel. An unprivileged local user could triger oops in
shash_async_export() by attempting to force the in-kernel hashing
algorithms into decrypting an empty data set.  Not all in kernel algorithms
are affected.

Upstream has already fixed this issue (See upstream patch) in 4.4rc1.

Thanks,

Wade Mealing
Red Hat Product Security


Upstream discussion:

https://lkml.org/lkml/2016/10/12/198

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4afa5f9617927453ac04b24b584f6c718dfb4f45

Red Hat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=1388821

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.