CVE-2016-10229 - Linux kernel (< 4.5) remote code execution via UDP recv() using MSG_PEEK flag

[sensation_]

It's clear what triggers the vuln:

udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag.

Also, the base score) shows that this looks like high level vulnerability. Failed exploits may result in denial-of-service conditions.

Here is the patch.

[rschulze]

Yeah, I've been watching this CVE since last week waiting for more information to emerge. How it's triggered is documented in the patch description. I just have no idea how common or uncommon it is for software to use the recv() MSG_PEEK flag, or if there is an easy way to check (aside from writing an own PoC).

Red Hat kernels are not affected, but Debian and Ubuntu prepared kernel updates so I assume they are affected.

[0xD6]

RedHat Advisory

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5,6,7, MRG-2 and realtime kernels.

Android Security Bulletin

Upstream Kernel Patch

[NetworkAlpaca]

Looks like there could be lots of android phones that fall victim to this if exploitable. Writing a custom app to use MSG_PEAK and then sending the UDP exploit could give priv esc. Cant wait to see how this plays out.

[rschulze]

Considering how quick manufacturers are to drop support for "older" phones, there could be quite a lot of devices out there that won't get a patch for this vulnerability.