Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5039 > unrolled thread
| Started by | Jan Lühr <jan@jluehr.de> |
|---|---|
| First post | 2016-10-04 19:00 +0200 |
| Last post | 2016-10-05 10:00 +0200 |
| Articles | 7 — 4 participants |
Back to article view | Back to linux.debian.security
CVE-2016-7117 Remote code execution vulnerability in kernel networking subsystem Jan Lühr <jan@jluehr.de> - 2016-10-04 19:00 +0200
Re: CVE-2016-7117 Remote code execution vulnerability in kernel networking subsystem Felix Knecht <debian@felixknecht.de> - 2016-10-04 19:50 +0200
Re: CVE-2016-7117 Remote code execution vulnerability in kernel networking subsystem Nicholas Luedtke <nicholas.luedtke@hpe.com> - 2016-10-04 20:00 +0200
Re: CVE-2016-7117 Remote code execution vulnerability in kernel networking subsystem Jan Lühr <jan@jluehr.de> - 2016-10-05 00:00 +0200
Re: CVE-2016-7117 Remote code execution vulnerability in kernel networking subsystem Salvatore Bonaccorso <carnil@debian.org> - 2016-10-05 07:00 +0200
Re: CVE-2016-7117 Remote code execution vulnerability in kernel networking subsystem Jan Lühr <jan@jluehr.de> - 2016-10-05 10:00 +0200
Re: CVE-2016-7117 Remote code execution vulnerability in kernel networking subsystem Salvatore Bonaccorso <carnil@debian.org> - 2016-10-05 10:00 +0200
| From | Jan Lühr <jan@jluehr.de> |
|---|---|
| Date | 2016-10-04 19:00 +0200 |
| Subject | CVE-2016-7117 Remote code execution vulnerability in kernel networking subsystem |
| Message-ID | <soBep-5lJ-5@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
Hello, CVE-2016-7117 was patched in Android today.I don't see much information right now. The title is rather frightening - the issue appears to be urgent. Can you confirm, that common Debian installation are unaffected and cannot be taken over via CVE-2016-7117? If not, I'd like to shut down a few boxes, unless there's a patch or work-around. Greetz, yanosz -- There's a ripped off cord To my TV screen With a note saying: "Im not afraid to dream" -- Donkey Boy, Crazy Something Normal
[toc] | [next] | [standalone]
| From | Felix Knecht <debian@felixknecht.de> |
|---|---|
| Date | 2016-10-04 19:50 +0200 |
| Message-ID | <soC0N-5S0-19@gated-at.bofh.it> |
| In reply to | #5039 |
On 10/04/2016 06:38 PM, Jan Lühr wrote: > CVE-2016-7117 was patched in Android today.I don't see much information > right now. The title is rather frightening - the issue appears to be urgent. The following upstream kernel commit is referenced in the security bulletin: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d No idea if this is fixed in Debian though. Felix
[toc] | [prev] | [next] | [standalone]
| From | Nicholas Luedtke <nicholas.luedtke@hpe.com> |
|---|---|
| Date | 2016-10-04 20:00 +0200 |
| Message-ID | <soCau-5Vn-19@gated-at.bofh.it> |
| In reply to | #5040 |
[Multipart message — attachments visible in raw view] — view raw
On 10/04/2016 11:40 AM, Felix Knecht wrote: > On 10/04/2016 06:38 PM, Jan Lühr wrote: >> CVE-2016-7117 was patched in Android today.I don't see much information >> right now. The title is rather frightening - the issue appears to be urgent. > The following upstream kernel commit is referenced in the security bulletin: > > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d > > No idea if this is fixed in Debian though. > > Felix > Looks like it was picked up when Debian rolled to 3.16.36-1. -- Nicholas Luedtke HPE Linux Security, Hewlett-Packard Enterprise
[toc] | [prev] | [next] | [standalone]
| From | Jan Lühr <jan@jluehr.de> |
|---|---|
| Date | 2016-10-05 00:00 +0200 |
| Message-ID | <soFUJ-8jf-5@gated-at.bofh.it> |
| In reply to | #5041 |
[Multipart message — attachments visible in raw view] — view raw
Hello, Am 10/04/2016 um 07:57 PM schrieb Nicholas Luedtke: > On 10/04/2016 11:40 AM, Felix Knecht wrote: > >> On 10/04/2016 06:38 PM, Jan Lühr wrote: >>> CVE-2016-7117 was patched in Android today.I don't see much information >>> right now. The title is rather frightening - the issue appears to be urgent. >> The following upstream kernel commit is referenced in the security bulletin: >> >> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d >> >> No idea if this is fixed in Debian though. >> >> Felix >> > Looks like it was picked up when Debian rolled to 3.16.36-1. Thanks for the info - if Felix is right, then 4.7 (jessie backports) is secure, since it was released months after the fix was pushed to the mainline kernel. However, it's somewhat strange that a bug labeled "Linux Kernel Use-After-Free Remote Code Execution Vulnerability", concerning a lot of kernels released in the last years (http://www.securityfocus.com/bid/93304) seem to be fixed in android only. Do you know any details? Anyway, using jessie-backports seem to help, thus I'm going for it... Thanks, Greetz, Jan -- There's a ripped off cord To my TV screen With a note saying: "Im not afraid to dream" -- Donkey Boy, Crazy Something Normal
[toc] | [prev] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2016-10-05 07:00 +0200 |
| Message-ID | <soMtb-4lJ-3@gated-at.bofh.it> |
| In reply to | #5042 |
Hi, On Tue, Oct 04, 2016 at 11:54:12PM +0200, Jan Lühr wrote: > Hello, > Am 10/04/2016 um 07:57 PM schrieb Nicholas Luedtke: > > On 10/04/2016 11:40 AM, Felix Knecht wrote: > > > >> On 10/04/2016 06:38 PM, Jan Lühr wrote: > >>> CVE-2016-7117 was patched in Android today.I don't see much information > >>> right now. The title is rather frightening - the issue appears to be urgent. > >> The following upstream kernel commit is referenced in the security bulletin: > >> > >> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d > >> > >> No idea if this is fixed in Debian though. > >> > >> Felix > >> > > Looks like it was picked up when Debian rolled to 3.16.36-1. > > Thanks for the info - if Felix is right, then 4.7 (jessie backports) is > secure, since it was released months after the fix was pushed to the > mainline kernel. > > However, it's somewhat strange that a bug labeled "Linux Kernel > Use-After-Free Remote Code Execution Vulnerability", concerning a lot of > kernels released in the last years > (http://www.securityfocus.com/bid/93304) seem to be fixed in android > only. Do you know any details? > > Anyway, using jessie-backports seem to help, thus I'm going for it... I updated the security-tracker information for CVE-2016-7117: https://security-tracker.debian.org/tracker/CVE-2016-7117 . The fix is as well included in 3.16.36-1. HTH, Regards, Salvatore
[toc] | [prev] | [next] | [standalone]
| From | Jan Lühr <jan@jluehr.de> |
|---|---|
| Date | 2016-10-05 10:00 +0200 |
| Message-ID | <soPho-6eP-1@gated-at.bofh.it> |
| In reply to | #5043 |
[Multipart message — attachments visible in raw view] — view raw
Hello, Am 10/05/2016 um 06:52 AM schrieb Salvatore Bonaccorso: > On Tue, Oct 04, 2016 at 11:54:12PM +0200, Jan Lühr wrote: >> Hello, >> Am 10/04/2016 um 07:57 PM schrieb Nicholas Luedtke: >>> On 10/04/2016 11:40 AM, Felix Knecht wrote: >>> >>>> On 10/04/2016 06:38 PM, Jan Lühr wrote: >>>>> CVE-2016-7117 was patched in Android today.I don't see much information >>>>> right now. The title is rather frightening - the issue appears to be urgent. >>>> The following upstream kernel commit is referenced in the security bulletin: >>>> >>>> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d >>>> >>>> No idea if this is fixed in Debian though. >>>> >>>> Felix >>>> >>> Looks like it was picked up when Debian rolled to 3.16.36-1. > I updated the security-tracker information for CVE-2016-7117: > > https://security-tracker.debian.org/tracker/CVE-2016-7117 . The fix is > as well included in 3.16.36-1. Thanks for the info! Updating dsa-3659 may help confused people like me ;-). Greetz, yanosz -- -- There's a ripped off cord To my TV screen With a note saying: "Im not afraid to dream" -- Donkey Boy, Crazy Something Normal
[toc] | [prev] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2016-10-05 10:00 +0200 |
| Message-ID | <soPho-6eP-9@gated-at.bofh.it> |
| In reply to | #5044 |
Hi Jan, On Wed, Oct 05, 2016 at 09:49:28AM +0200, Jan Lühr wrote: > Hello, > > > Am 10/05/2016 um 06:52 AM schrieb Salvatore Bonaccorso: > > On Tue, Oct 04, 2016 at 11:54:12PM +0200, Jan Lühr wrote: > >> Hello, > >> Am 10/04/2016 um 07:57 PM schrieb Nicholas Luedtke: > >>> On 10/04/2016 11:40 AM, Felix Knecht wrote: > >>> > >>>> On 10/04/2016 06:38 PM, Jan Lühr wrote: > >>>>> CVE-2016-7117 was patched in Android today.I don't see much information > >>>>> right now. The title is rather frightening - the issue appears to be urgent. > >>>> The following upstream kernel commit is referenced in the security bulletin: > >>>> > >>>> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d > >>>> > >>>> No idea if this is fixed in Debian though. > >>>> > >>>> Felix > >>>> > >>> Looks like it was picked up when Debian rolled to 3.16.36-1. > > I updated the security-tracker information for CVE-2016-7117: > > > > https://security-tracker.debian.org/tracker/CVE-2016-7117 . The fix is > > as well included in 3.16.36-1. > > Thanks for the info! > Updating dsa-3659 may help confused people like me ;-). I'm a bit against it doing any further change to the text for DSA-3659. The DSA was for the CVEs included in the 3.16.36-1+deb8u1, 3.16.36-1 was back then already accepted for the next point release and the fix is in the 3.16.36-1 part of the upload, not in the 3.16.36-1+deb8u1 upload for DSA-3659. I hope though the direct link to the CVE, as https://security-tracker.debian.org/tracker/CVE-2016-7117 is helpfull enough. Thanks though for the comment! Regards, Salvatore
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web