oss-sec mailing list archives
CVE-2016-6327 | Linux kernel crash in infiniband subsystem.
From: Wade Mealing <wmealing () redhat com>
Date: Fri, 19 Aug 2016 17:10:30 +1000
System using the infiniband support module ib_srpt were vulnerable to a denial of service by system crash by a local attacker who is able to abort writes to a device using this initiator. There were multiple areas in which aborting a scsi command are able to be handled, moving this to the correct location in the state machine ensured that this condition was never triggered through this code path. The null pointer situation was enabled via a non attacker controlled meset() call, and this is not a use after free. From my undestanding it is a denial of service only. Thanks, Wade Mealing https://bugzilla.redhat.com/show_bug.cgi?id=1354525 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51093254bf87
Current thread:
- CVE-2016-6327 | Linux kernel crash in infiniband subsystem. Wade Mealing (Aug 19)
- Re: CVE-2016-6327 | Linux kernel crash in infiniband subsystem. Greg KH (Aug 19)