CVE-2016-9793

Published: 28 December 2016

The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUFFORCE or (2) SO_RCVBUFFORCE option.

From the Ubuntu Security Team

Andrey Konovalov discovered that signed integer overflows existed in the setsockopt() system call when handling the SO_SNDBUFFORCE and SO_RCVBUFFORCE options. A local attacker with the CAP_NET_ADMIN capability could use this to cause a denial of service (system crash or memory corruption).

Notes

the overflows exist for SO_{SND|RCV}BUFFORCE, so it's
possible for a process with CAP_NET_ADMIN to do this. However,
the check for CAP_NET_ADMIN is via capable() *not* ns_capable(),
so the process attempting this has to have CAP_NET_ADMIN in the
init_ns; having it in a new user namespace (i.e. via unshare()) is
not sufficient. Thus, this cannot be exploited by an unprivileged
user dropping into an unprivileged user namespace. Hence the
low priority.

Status

Severity score breakdown

References

• http://www.openwall.com/lists/oss-security/2016/12/02
• https://github.com/torvalds/linux/commit/b98b0bc8c431e3ceb4b26b0dfc8db509518fb290
• https://ubuntu.com/security/notices/USN-3168-1
• https://ubuntu.com/security/notices/USN-3168-2
• https://ubuntu.com/security/notices/USN-3169-1
• https://ubuntu.com/security/notices/USN-3169-2
• https://ubuntu.com/security/notices/USN-3169-3
• https://ubuntu.com/security/notices/USN-3169-4
• https://ubuntu.com/security/notices/USN-3170-1
• https://ubuntu.com/security/notices/USN-3170-2
• https://www.cve.org/CVERecord?id=CVE-2016-9793
• NVD
• Launchpad
• Debian