A vulnerability was found in Linux Kernel 3.10.0 (Operating System). It has been rated as critical. Affected by this issue is the function icmp_check_sysrq of the file net/ipv4/icmp.c of the component ICMP Echo Request Handler. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327.22.1 in Red Hat Enterprise Linux for Real Time 7 and other products, allows remote attackers to execute SysRq commands via crafted ICMP Echo Request packets, as demonstrated by a brute-force attack to discover a cookie, or an attack that occurs after reading the local icmp_echo_sysrq file.

The weakness was published 05/17/2016 (oss-sec). The advisory is available at openwall.com. This vulnerability is handled as CVE-2016-3707 since 03/30/2016. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project. The advisory points out:

A flaw was found in the kernel-rt in which an attacker could submit a specially crafted ICMP echo request which can trigger a sysrq function based on values in the ICMP packet. This feature was introduced in the kernel-rt only and is not shipping with standard Red Hat Enterprise Linux kernels. Other kernels also ship this patch.

The vulnerability scanner Nessus provides a plugin with the ID 91805 (RHEL 7 : kernel-rt (RHSA-2016:1301)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Red Hat Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 236033 (Red Hat Update for kernel-rt (RHSA-2016:1301)). The advisory illustrates:

When enabled, remote attacker who are able to send ICMP packets to the host could exploit this feature using bruteforce to submit arbitrary SysRq commands.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at kernel.org.Addressing this vulnerability is possible by firewalling ICMP. The best possible mitigation is suggested to be patching the affected component. A possible mitigation has been published before and not just after the disclosure of the vulnerability. The advisory contains the following remark:

(...) this feature can be disabled / reverted in the code and usual methods of sysrq magic keys can be used as a workaround till a sufficient alternative has been developed.

The vulnerability is also documented in the vulnerability database at Tenable (91805). seclists.org is providing further details. Similar entries are available at 88374, 88373, 88371 and 88369.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 3.10.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion