Linux Kernel 2.6.32 Thread tcp_recvmsg memory corruption

Summaryinfo

A vulnerability described as critical has been identified in Linux Kernel 2.6.32. The affected element is the function tcp_recvmsg of the component Thread Handler. Executing a manipulation can lead to memory corruption. This vulnerability appears as CVE-2019-3837. The attack requires local access. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Linux Kernel 2.6.32 (Operating System) and classified as critical. This vulnerability affects the function tcp_recvmsg of the component Thread Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.

The bug was discovered 04/03/2019. The weakness was presented 04/11/2019 as not defined bug report (Bugzilla). The advisory is shared for download at bugzilla.redhat.com. This vulnerability was named CVE-2019-3837 since 01/03/2019. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k.

Upgrading eliminates this vulnerability.

See VDB-133347 and VDB-133346 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 2.6.32

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion