The tipc_msg_build function in net/tipc/msg.c in the Linux kernel through 4.8.11 does not validate the relationship between the minimum fragment length and the maximum packet size, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) by leveraging the CAP_NET_ADMIN capability.
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
| Link | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2016/11/08/5 | third party advisory mailing list |
| https://bugzilla.redhat.com/show_bug.cgi?id=1390832 | issue tracking |
| http://www.securityfocus.com/bid/94211 | vdb entry third party advisory |
| https://www.mail-archive.com/netdev%40vger.kernel.org/msg133205.html | mailing list |