CVE-2017-7558
published 2018-07-26CVE-2017-7558: A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present…
PriorityP351high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
3.76%
88.7th percentile
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 4.12.13-1 (bookworm) | linux 4.12.13-1 (bookworm) |
| linux | kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 4.12.13-1 | 4.12.13-1 |
| linux | linux_kernel | >= 0 < 4.12.13-1 | 4.12.13-1 |
| linux | linux_kernel | >= 0 < 4.12.13-1 | 4.12.13-1 |
| linux | linux_kernel | >= 0 < 4.12.13-1 | 4.12.13-1 |
| linux | linux_kernel | 4.7 – 4.13 | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian5.1MEDIUM
vendor_redhat5.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5vf3-w6cv-wf86: A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions p
ghsa_unreviewed·2022-05-13
CVE-2017-7558 [HIGH] CWE-125 GHSA-5vf3-w6cv-wf86: A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions p
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.
OSV
CVE-2017-7558: A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions p
osv·2018-07-26·CVSS 7.5
CVE-2017-7558 [HIGH] CVE-2017-7558: A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions p
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.
Kernel
sctp: Avoid out-of-bounds reads from address storage
kernel_security·2017-08-23
CVE-2017-7558 sctp: Avoid out-of-bounds reads from address storage
sctp: Avoid out-of-bounds reads from address storage
inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() copy
sizeof(sockaddr_storage) bytes to fill in sockaddr structs used
to export diagnostic information to userspace.
However, the memory allocated to store sockaddr information is
smaller than that and depends on the address family, so we leak
up to 100 uninitialized bytes to userspace. Just use the size of
the source structs instead, in all the three cases this is what
userspace expects. Zero out the remaining memory.
Unused bytes (i.e. when IPv4 addresses are used) in source
structs sctp_sockaddr_entry and sctp_transport are already
cleared by sctp_add_bind_addr() and sctp_transport_new(),
respectively.
Noticed while testing KASAN-enabled kernel with 'ss':
[ 2326.885243] BU
Red Hat
kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack
vendor_redhat·2017-08-23·CVSS 5.1
CVE-2017-7558 [MEDIUM] CWE-125 kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack
kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export sock
Debian
CVE-2017-7558: linux - A kernel data leak due to an out-of-bound read was found in the Linux kernel in ...
vendor_debian·2017·CVSS 5.1
CVE-2017-7558 [MEDIUM] CVE-2017-7558: linux - A kernel data leak due to an out-of-bound read was found in the Linux kernel in ...
A kernel data leak due to an out-of-bound read was found in the Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since version 4.7-rc1 through version 4.13. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result, up to 100 bytes of the slab data could be leaked to a userspace.
Scope: local
bookworm: resolved (fixed in 4.12.13-1)
bullseye: resolved (fixed in 4.12.13-1)
forky: resolved (fixed in 4.12.13-1)
sid: resolved (fixed in 4.12.13-1)
trixie: resolved (fixed in 4.12.13-1)
No detection rules found.
Bugzilla
CVE-2017-7558 kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack [fedora-all]
bugzilla·2017-08-24·CVSS 5.1
CVE-2017-7558 [MEDIUM] CVE-2017-7558 kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack [fedora-all]
CVE-2017-7558 kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Bugzilla
CVE-2017-7558 kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack
bugzilla·2017-08-10·CVSS 5.1
CVE-2017-7558 [MEDIUM] CVE-2017-7558 kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack
CVE-2017-7558 kernel: Out of bounds read in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() in SCTP stack
A kernel data leak due to an out-of-bound read was found in Linux kernel in inet_diag_msg_sctp{,l}addr_fill() and sctp_get_sctp_info() functions present since v4.7-rc1 upto v4.13 including. A data leak happens when these functions fill in sockaddr data structures used to export socket's diagnostic information. As a result upto 100 bytes of the slab data could be leaked to a userspace.
References:
http://seclists.org/oss-sec/2017/q3/338
https://marc.info/?t=150348787500002&r=1&w=2
Proposed upstream patch:
https://marc.info/?l=linux-netdev&m=150348777122761&w=2
Discussion:
Acknowledgments:
Name: Stefano Brivio (Red Hat)
---
Statement:
This issue does not affect Red
http://seclists.org/oss-sec/2017/q3/338http://www.securityfocus.com/bid/100466http://www.securitytracker.com/id/1039221https://access.redhat.com/errata/RHSA-2017:2918https://access.redhat.com/errata/RHSA-2017:2930https://access.redhat.com/errata/RHSA-2017:2931https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7558https://marc.info/?l=linux-netdev&m=150348777122761&w=2https://www.debian.org/security/2017/dsa-3981http://seclists.org/oss-sec/2017/q3/338http://www.securityfocus.com/bid/100466http://www.securitytracker.com/id/1039221https://access.redhat.com/errata/RHSA-2017:2918https://access.redhat.com/errata/RHSA-2017:2930https://access.redhat.com/errata/RHSA-2017:2931https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7558https://marc.info/?l=linux-netdev&m=150348777122761&w=2https://www.debian.org/security/2017/dsa-3981
2018-07-26
Published