Bug 1058410 (CVE-2017-12153) - VUL-0: CVE-2017-12153: kernel-source: null pointer dereference in nl80211_set_rekey_data()
Summary: VUL-0: CVE-2017-12153: kernel-source: null pointer dereference in nl80211_set...
Status: RESOLVED FIXED
Alias: CVE-2017-12153
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Luis Chamberlain
URL: https://smash.suse.de/issue/191845/
Whiteboard: CVSSv3:SUSE:CVE-2017-12153:4.4:(AV:L/...
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-13 05:37 UTC by Marcus Meissner
Modified: 2024-06-25 13:42 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2017-09-13 05:37:46 UTC 
rh#1491046

A security flaw is present in nl80211_set_rekey_data() function in the Linux kernel since v3.1-rc1. This function does not check whether required attributes are present in a netlink request. This request can be issued by a user with CAP_NET_ADMIN privilege and may result in NULL dereference and a system crash.

References:

https://marc.info/?t=150525503100001&r=1&w=2

Suggested upstream patch:

https://marc.info/?l=linux-wireless&m=150525493517953&w=2

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1491046
Comment 4 Luis Chamberlain 2017-09-19 06:49:39 UTC 
Its a trivial fix that makes sense, just the fact that it got picked up on Johannes's tree is enough for me. Pushed. I will update the patch with a commit ID once it lands on Linus' tree. It will be a little while before it hits Linus' tree.
Comment 5 Luis Chamberlain 2017-09-19 06:51:24 UTC 
Re-assigning to security now.
Comment 7 Luis Chamberlain 2017-09-20 13:00:00 UTC 
I've only pushed it onto cve/linux-3.12 given the fix is for a function added via commit e5497d766adb9 ("cfg80211/nl80211: support GTK rekey offload") which was merged on v3.1-rc1. Prior to  v3.1 we did not have GTK rekey offload support.

Other cve branches are not affected then.
Comment 8 Luis Chamberlain 2017-09-20 13:19:39 UTC 
(In reply to Luis Rodriguez from comment #7)
> I've only pushed it onto cve/linux-3.12 given the fix is for a function
> added via commit e5497d766adb9 ("cfg80211/nl80211: support GTK rekey
> offload") which was merged on v3.1-rc1. Prior to  v3.1 we did not have GTK
> rekey offload support.
> 
> Other cve branches are not affected then.

I was misreading the graph, and will update a few more branches next:

 o SLE12-SP2
 o SLE15
 o stable
 o master
Comment 9 Luis Chamberlain 2017-09-20 14:12:55 UTC 
OK now pushed on all these branches:

  o users/lurodriguez/stable/for-next
  o users/lurodriguez/master/for-next
  o users/lurodriguez/SLE15/for-next
  o users/lurodriguez/SLE12-SP2/for-next
  o users/lurodriguez/cve/linux-3.12/for-next
Comment 10 Swamp Workflow Management 2017-10-17 13:11:12 UTC 
openSUSE-SU-2017:2739-1: An update that solves four vulnerabilities and has 15 fixes is now available.

Category: security (important)
Bug References: 1012382,1022967,1052593,1055493,1055755,1055896,1058038,1058410,1058507,1059051,1059465,1060197,1061017,1061046,1061064,1061067,1061172,1061831,1061872
CVE References: CVE-2017-1000252,CVE-2017-12153,CVE-2017-12154,CVE-2017-14489
Sources used:
openSUSE Leap 42.2 (src):    kernel-debug-4.4.90-18.32.1, kernel-default-4.4.90-18.32.1, kernel-docs-4.4.90-18.32.2, kernel-obs-build-4.4.90-18.32.1, kernel-obs-qa-4.4.90-18.32.1, kernel-source-4.4.90-18.32.1, kernel-syms-4.4.90-18.32.1, kernel-vanilla-4.4.90-18.32.1
Comment 11 Swamp Workflow Management 2017-10-17 13:19:13 UTC 
openSUSE-SU-2017:2741-1: An update that solves four vulnerabilities and has 33 fixes is now available.

Category: security (important)
Bug References: 1005778,1005780,1005781,1012382,1022967,1036215,1036737,1037579,1037890,1043598,1044503,1047238,1051987,1052593,1053043,1055493,1055755,1056686,1057383,1057498,1058038,1058410,1058507,1058512,1058550,1059051,1059465,1059500,1060197,1060229,1061017,1061046,1061064,1061067,1061172,1061831,1061872
CVE References: CVE-2017-1000252,CVE-2017-12153,CVE-2017-12154,CVE-2017-14489
Sources used:
openSUSE Leap 42.3 (src):    kernel-debug-4.4.90-28.1, kernel-default-4.4.90-28.1, kernel-docs-4.4.90-28.2, kernel-obs-build-4.4.90-28.1, kernel-obs-qa-4.4.90-28.1, kernel-source-4.4.90-28.1, kernel-syms-4.4.90-28.1, kernel-vanilla-4.4.90-28.1
Comment 12 Swamp Workflow Management 2017-10-25 13:35:42 UTC 
SUSE-SU-2017:2847-1: An update that solves 11 vulnerabilities and has 170 fixes is now available.

Category: security (important)
Bug References: 1004527,1005776,1005778,1005780,1005781,1012382,1012829,1015342,1015343,1019675,1019680,1019695,1019699,1020412,1020645,1020657,1020989,1021424,1022595,1022604,1022743,1022912,1022967,1024346,1024373,1024405,1025461,1030850,1031717,1031784,1032150,1034048,1034075,1035479,1036060,1036215,1036737,1037579,1037838,1037890,1038583,1040813,1042847,1043598,1044503,1046529,1047238,1047487,1047989,1048155,1048228,1048325,1048327,1048356,1048501,1048893,1048912,1048934,1049226,1049272,1049291,1049336,1049361,1049580,1050471,1050742,1051790,1051987,1052093,1052094,1052095,1052360,1052384,1052580,1052593,1052888,1053043,1053309,1053472,1053627,1053629,1053633,1053681,1053685,1053802,1053915,1053919,1054082,1054084,1054654,1055013,1055096,1055272,1055290,1055359,1055493,1055567,1055709,1055755,1055896,1055935,1055963,1056061,1056185,1056230,1056261,1056427,1056587,1056588,1056596,1056686,1056827,1056849,1056982,1057015,1057031,1057035,1057038,1057047,1057067,1057383,1057498,1057849,1058038,1058116,1058135,1058410,1058507,1058512,1058550,1059051,1059465,1059500,1059863,1060197,1060229,1060249,1060400,1060985,1061017,1061046,1061064,1061067,1061172,1061451,1061721,1061775,1061831,1061872,1062279,1062520,1062962,1063102,1063349,1063460,1063475,1063479,1063501,1063509,1063520,1063570,1063667,1063671,1063695,1064064,1064206,1064388,1064436,963575,964944,966170,966172,966186,966191,966316,966318,969476,969477,969756,971975,981309
CVE References: CVE-2017-1000252,CVE-2017-11472,CVE-2017-12134,CVE-2017-12153,CVE-2017-12154,CVE-2017-13080,CVE-2017-14051,CVE-2017-14106,CVE-2017-14489,CVE-2017-15265,CVE-2017-15649
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    kernel-default-4.4.92-6.18.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    kernel-docs-4.4.92-6.18.3, kernel-obs-build-4.4.92-6.18.1
SUSE Linux Enterprise Server 12-SP3 (src):    kernel-default-4.4.92-6.18.1, kernel-source-4.4.92-6.18.1, kernel-syms-4.4.92-6.18.1
SUSE Linux Enterprise Live Patching 12-SP3 (src):    kgraft-patch-SLE12-SP3_Update_4-1-4.3
SUSE Linux Enterprise High Availability 12-SP3 (src):    kernel-default-4.4.92-6.18.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    kernel-default-4.4.92-6.18.1, kernel-source-4.4.92-6.18.1, kernel-syms-4.4.92-6.18.1
Comment 13 Swamp Workflow Management 2017-10-27 16:49:45 UTC 
SUSE-SU-2017:2869-1: An update that solves 16 vulnerabilities and has 120 fixes is now available.

Category: security (important)
Bug References: 1006180,1011913,1012382,1012829,1013887,1019151,1020645,1020657,1021424,1022476,1022743,1022967,1023175,1024405,1028173,1028286,1029693,1030552,1030850,1031515,1031717,1031784,1033587,1034048,1034075,1034762,1036303,1036632,1037344,1037404,1037994,1038078,1038583,1038616,1038792,1039915,1040307,1040351,1041958,1042286,1042314,1042422,1042778,1043652,1044112,1044636,1045154,1045563,1045922,1046682,1046821,1046985,1047027,1047048,1047096,1047118,1047121,1047152,1047277,1047343,1047354,1047487,1047651,1047653,1047670,1048155,1048221,1048317,1048891,1048893,1048914,1048934,1049226,1049483,1049486,1049580,1049603,1049645,1049882,1050061,1050188,1051022,1051059,1051239,1051399,1051478,1051479,1051556,1051663,1051790,1052049,1052223,1052533,1052580,1052593,1052709,1052773,1052794,1052888,1053117,1053802,1053915,1053919,1054084,1055013,1055096,1055359,1055493,1055755,1055896,1056261,1056588,1056827,1056982,1057015,1058038,1058116,1058410,1058507,1059051,1059465,1060197,1061017,1061046,1061064,1061067,1061172,1061831,1061872,1063667,1064206,1064388,964063,971975,974215,981309
CVE References: CVE-2017-1000252,CVE-2017-10810,CVE-2017-11472,CVE-2017-11473,CVE-2017-12134,CVE-2017-12153,CVE-2017-12154,CVE-2017-13080,CVE-2017-14051,CVE-2017-14106,CVE-2017-14489,CVE-2017-15649,CVE-2017-7518,CVE-2017-7541,CVE-2017-7542,CVE-2017-8831
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    kernel-default-4.4.90-92.45.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    kernel-docs-4.4.90-92.45.3, kernel-obs-build-4.4.90-92.45.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    kernel-default-4.4.90-92.45.1, kernel-source-4.4.90-92.45.1, kernel-syms-4.4.90-92.45.1
SUSE Linux Enterprise Server 12-SP2 (src):    kernel-default-4.4.90-92.45.1, kernel-source-4.4.90-92.45.1, kernel-syms-4.4.90-92.45.1
SUSE Linux Enterprise Live Patching 12 (src):    kgraft-patch-SLE12-SP2_Update_14-1-2.4
SUSE Linux Enterprise High Availability 12-SP2 (src):    kernel-default-4.4.90-92.45.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    kernel-default-4.4.90-92.45.1, kernel-source-4.4.90-92.45.1, kernel-syms-4.4.90-92.45.1
SUSE Container as a Service Platform ALL (src):    kernel-default-4.4.90-92.45.1
OpenStack Cloud Magnum Orchestration 7 (src):    kernel-default-4.4.90-92.45.1
Comment 14 Swamp Workflow Management 2017-10-30 18:31:41 UTC 
SUSE-SU-2017:2908-1: An update that solves 30 vulnerabilities and has 38 fixes is now available.

Category: security (important)
Bug References: 1001459,1012985,1023287,1027149,1028217,1030531,1030552,1031515,1033960,1034405,1035531,1035738,1037182,1037183,1037994,1038544,1038564,1038879,1038883,1038981,1038982,1039348,1039354,1039456,1039721,1039864,1039882,1039883,1039885,1040069,1041160,1041429,1041431,1042696,1042832,1042863,1044125,1045327,1045487,1045922,1046107,1048275,1048788,1049645,1049882,1053148,1053152,1053317,1056588,1056982,1057179,1058410,1058507,1058524,1059863,1062471,1062520,1063667,1064388,856774,860250,863764,878240,922855,922871,986924,993099,994364
CVE References: CVE-2017-1000363,CVE-2017-1000365,CVE-2017-1000380,CVE-2017-10661,CVE-2017-11176,CVE-2017-12153,CVE-2017-12154,CVE-2017-12762,CVE-2017-13080,CVE-2017-14051,CVE-2017-14106,CVE-2017-14140,CVE-2017-15265,CVE-2017-15274,CVE-2017-15649,CVE-2017-7482,CVE-2017-7487,CVE-2017-7518,CVE-2017-7541,CVE-2017-7542,CVE-2017-7889,CVE-2017-8831,CVE-2017-8890,CVE-2017-8924,CVE-2017-8925,CVE-2017-9074,CVE-2017-9075,CVE-2017-9076,CVE-2017-9077,CVE-2017-9242
Sources used:
SUSE OpenStack Cloud 6 (src):    kernel-default-3.12.74-60.64.63.1, kernel-source-3.12.74-60.64.63.1, kernel-syms-3.12.74-60.64.63.1, kernel-xen-3.12.74-60.64.63.1, kgraft-patch-SLE12-SP1_Update_22-1-2.1
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    kernel-default-3.12.74-60.64.63.1, kernel-source-3.12.74-60.64.63.1, kernel-syms-3.12.74-60.64.63.1, kernel-xen-3.12.74-60.64.63.1, kgraft-patch-SLE12-SP1_Update_22-1-2.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    kernel-default-3.12.74-60.64.63.1, kernel-source-3.12.74-60.64.63.1, kernel-syms-3.12.74-60.64.63.1, kernel-xen-3.12.74-60.64.63.1, kgraft-patch-SLE12-SP1_Update_22-1-2.1
SUSE Linux Enterprise Module for Public Cloud 12 (src):    kernel-ec2-3.12.74-60.64.63.1
Comment 15 Swamp Workflow Management 2017-11-02 17:20:13 UTC 
SUSE-SU-2017:2920-1: An update that solves 36 vulnerabilities and has 22 fixes is now available.

Category: security (important)
Bug References: 1008353,1012422,1017941,1029850,1030593,1032268,1034405,1034670,1035576,1035877,1036752,1037182,1037183,1037306,1037994,1038544,1038879,1038981,1038982,1039348,1039349,1039354,1039456,1039721,1039882,1039883,1039885,1040069,1041431,1041958,1044125,1045327,1045487,1045922,1046107,1047408,1048275,1049645,1049882,1052593,1053148,1053152,1056588,1056982,1057179,1058038,1058410,1058507,1058524,1062520,1063667,1064388,938162,975596,977417,984779,985562,990682
CVE References: CVE-2015-9004,CVE-2016-10229,CVE-2016-9604,CVE-2017-1000363,CVE-2017-1000365,CVE-2017-1000380,CVE-2017-10661,CVE-2017-11176,CVE-2017-12153,CVE-2017-12154,CVE-2017-12762,CVE-2017-13080,CVE-2017-14051,CVE-2017-14106,CVE-2017-14140,CVE-2017-15265,CVE-2017-15274,CVE-2017-15649,CVE-2017-2647,CVE-2017-6951,CVE-2017-7482,CVE-2017-7487,CVE-2017-7518,CVE-2017-7541,CVE-2017-7542,CVE-2017-7889,CVE-2017-8106,CVE-2017-8831,CVE-2017-8890,CVE-2017-8924,CVE-2017-8925,CVE-2017-9074,CVE-2017-9075,CVE-2017-9076,CVE-2017-9077,CVE-2017-9242
Sources used:
SUSE Linux Enterprise Server 12-LTSS (src):    kernel-default-3.12.61-52.101.1, kernel-source-3.12.61-52.101.1, kernel-syms-3.12.61-52.101.1, kernel-xen-3.12.61-52.101.1, kgraft-patch-SLE12_Update_28-1-8.1
SUSE Linux Enterprise Module for Public Cloud 12 (src):    kernel-ec2-3.12.61-52.101.1
Comment 16 Swamp Workflow Management 2017-12-12 14:11:46 UTC 
SUSE-SU-2017:3267-1: An update that solves 5 vulnerabilities and has 56 fixes is now available.

Category: security (important)
Bug References: 1012382,1017461,1020645,1022595,1022600,1022914,1022967,1025461,1028971,1030061,1034048,1037890,1052593,1053919,1055493,1055567,1055755,1055896,1056427,1058135,1058410,1058624,1059051,1059465,1059863,1060197,1060985,1061017,1061046,1061064,1061067,1061172,1061451,1061831,1061872,1062520,1062962,1063460,1063475,1063501,1063509,1063520,1063667,1063695,1064206,1064388,1064701,964944,966170,966172,966186,966191,966316,966318,969474,969475,969476,969477,971975,974590,996376
CVE References: CVE-2017-12153,CVE-2017-13080,CVE-2017-14489,CVE-2017-15265,CVE-2017-15649
Sources used:
SUSE Linux Enterprise Real Time Extension 12-SP2 (src):    kernel-rt-4.4.95-21.1, kernel-rt_debug-4.4.95-21.1, kernel-source-rt-4.4.95-21.1, kernel-syms-rt-4.4.95-21.1
Comment 17 Marcus Meissner 2017-12-19 16:15:23 UTC 
released