CVE-2016-3707 The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327.22.1 in Red Hat Enterprise Linux for Rea...
HighCVSS 8.1
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The icmp_check_sysrq function in net/ipv4/icmp.c in the kernel.org projects/rt patches for the Linux kernel, as used in the kernel-rt package before 3.10.0-327.22.1 in Red Hat Enterprise Linux for Real Time 7 and other products, allows remote attackers to execute SysRq commands via crafted ICMP Echo Request packets, as demonstrated by a brute-force attack to discover a cookie, or an attack that occurs after reading the local icmp_echo_sysrq file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 3.15~rc5-1~exp1 | 3.15~rc5-1~exp1 |
| debian/linux(Debian:13) | < 3.15~rc5-1~exp1 | 3.15~rc5-1~exp1 |
| debian/linux(Debian:14) | < 3.15~rc5-1~exp1 | 3.15~rc5-1~exp1 |
| linux kernel-rt | <= 3.10.0 | No fix listed |
| redhat enterprise linux for real time | = 7 | No fix listed |
| redhat enterprise linux for real time for nfv | = 7 | No fix listed |
| novell suse linux enterprise real time extension | = 12.0-sp1 | No fix listed |
References
- Debian Security Tracker CVE-2016-3707 vendor-advisory
- SUSE-SU-2016:1764 third-party-advisory vendor-advisory
- SUSE-SU-2016:1937 third-party-advisory vendor-advisory
- SUSE-SU-2016:1985 vendor-advisory
- [oss-security] 20160517 CVE-2016-3707 : kernel-rt - Sending SysRq command via ICMP echo request mailing-list
- RHSA-2016:1301 third-party-advisory vendor-advisory
- RHSA-2016:1341 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking