CVE-2012-6704
published 2016-12-28CVE-2012-6704: The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users…
PriorityP433high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.41%
34.0th percentile
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.8.11-1 (bookworm) | linux 3.8.11-1 (bookworm) |
| linux | linux_kernel | < 3.2.85 | 3.2.85 |
| linux | linux_kernel | >= 0 < 3.8.11-1 | 3.8.11-1 |
| linux | linux_kernel | >= 0 < 3.8.11-1 | 3.8.11-1 |
| linux | linux_kernel | >= 0 < 3.8.11-1 | 3.8.11-1 |
| linux | linux_kernel | >= 0 < 3.8.11-1 | 3.8.11-1 |
| linux | linux_kernel | >= 3.3 < 3.5 | 3.5 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xqxm-8fx9-rwr3: The sock_setsockopt function in net/core/sock
ghsa_unreviewed·2022-05-17
CVE-2012-6704 [HIGH] CWE-119 GHSA-xqxm-8fx9-rwr3: The sock_setsockopt function in net/core/sock
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.
OSV
CVE-2012-6704: The sock_setsockopt function in net/core/sock
osv·2016-12-28·CVSS 7.8
CVE-2012-6704 [HIGH] CVE-2012-6704: The sock_setsockopt function in net/core/sock
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.
Red Hat
kernel: Signed overflows in SO_{SND|RCV}BUF in sock_setsockopt()
vendor_redhat·2012-04-26·CVSS 7.8
CVE-2012-6704 [HIGH] CWE-190 kernel: Signed overflows in SO_{SND|RCV}BUF in sock_setsockopt()
kernel: Signed overflows in SO_{SND|RCV}BUF in sock_setsockopt()
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.
A flaw was found in the Linux kernel's implementation of setsockopt for the SO_{SND|RCV}BUF setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
Statement: This issue does not affect the kernels as shipping with R
Debian
CVE-2012-6704: linux - The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 m...
vendor_debian·2012·CVSS 7.8
CVE-2012-6704 [HIGH] CVE-2012-6704: linux - The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 m...
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.
Scope: local
bookworm: resolved (fixed in 3.8.11-1)
bullseye: resolved (fixed in 3.8.11-1)
forky: resolved (fixed in 3.8.11-1)
sid: resolved (fixed in 3.8.11-1)
trixie: resolved (fixed in 3.8.11-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-6704 kernel: Signed overflows in SO_{SND|RCV}BUF in sock_setsockopt()
bugzilla·2016-12-06·CVSS 7.8
CVE-2012-6704 [HIGH] CVE-2012-6704 kernel: Signed overflows in SO_{SND|RCV}BUF in sock_setsockopt()
CVE-2012-6704 kernel: Signed overflows in SO_{SND|RCV}BUF in sock_setsockopt()
A flaw was found in the Linux kernels implementation of setsockopt for the SO_{SND|RCV}BUF setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
This situation affects SO_SNDBUFF and SO_RCVBUFF similarly as shown in CVE-2016-9793.
Upstream patch:
https://github.com/torvalds/linux/commit/82981930125abfd39d7c8378a9cfdf5e1be2002b
CVE assignment:
http://seclists.org/oss-sec/2016/q4/574
Discussion:
Statement:
This issue does not affect the kernels as shipping wit
Bugzilla
CVE-2016-9793 kernel: Signed overflow for SO_{SND|RCV}BUFFORCE
bugzilla·2016-12-06·CVSS 7.8
CVE-2016-9793 [HIGH] CVE-2016-9793 kernel: Signed overflow for SO_{SND|RCV}BUFFORCE
CVE-2016-9793 kernel: Signed overflow for SO_{SND|RCV}BUFFORCE
A flaw was found in the Linux kernels implementation of setsockopt for the SO_{SND|RCV}BUFFORCE setsockopt() system call. Users with non-namespace CAP_NET_ADMIN are able to trigger this call and create a situation in which the sockets sendbuff data size could be negative.
This could adversely affect memory allocations and create situations where the system could crash or cause memory corruption.
This situation affects SO_SNDBUFF and SO_RCVBUFF similarly as shown in CVE-2012-6704.
Upstream patch:
https://github.com/torvalds/linux/commit/b98b0bc8c431e3ceb4b26b0dfc8db509518fb290
CVE assignment:
http://seclists.org/oss-sec/2016/q4/574
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 140201
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=82981930125abfd39d7c8378a9cfdf5e1be2002bhttp://www.openwall.com/lists/oss-security/2016/12/03/1http://www.securityfocus.com/bid/95135https://bugzilla.redhat.com/show_bug.cgi?id=1402024https://github.com/torvalds/linux/commit/82981930125abfd39d7c8378a9cfdf5e1be2002bhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=82981930125abfd39d7c8378a9cfdf5e1be2002bhttp://www.openwall.com/lists/oss-security/2016/12/03/1http://www.securityfocus.com/bid/95135https://bugzilla.redhat.com/show_bug.cgi?id=1402024https://github.com/torvalds/linux/commit/82981930125abfd39d7c8378a9cfdf5e1be2002b
2016-12-28
Published