CVE-2015-3636
Find out more about CVE-2015-3636 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
This issue does not affect the Linux kernel as shipped with Red Hat Enterprise Linux 5. This issue does affect the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7 and Red Hat Enterprise MRG 2. Future kernel updates for the respective releases will address this issue.
Please note that on x86-64 architecture systems the impact is limited to local Denial of Service and that the ping sockets functionality is disabled by default (net.ipv4.ping_group_range sysctl is "1 0").
CVSS v2 metrics
| Base Score | 6 |
|---|---|
| Base Metrics | AV:L/AC:H/Au:S/C:C/I:C/A:C |
| Access Vector | Local |
| Access Complexity | High |
| Authentication | Single |
| Confidentiality Impact | Complete |
| Integrity Impact | Complete |
| Availability Impact | Complete |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux for Real Time for NFV (v. 7) (kernel-rt) | RHSA-2015:1565 | 2015-08-05 |
| Red Hat Enterprise Linux 7 (kernel) | RHSA-2015:1534 | 2015-08-06 |
| Red Hat Enterprise Linux 6 (kernel) | RHSA-2015:1221 | 2015-07-14 |
| Red Hat Enterprise Linux Extended Update Support 6.5 (kernel) | RHSA-2015:1583 | 2015-08-11 |
| Red Hat MRG Grid for RHEL 6 Server v.2 (kernel-rt) | RHSA-2015:1564 | 2015-08-05 |
| Red Hat Enterprise Linux Advanced Update Support 6.4 (kernel) | RHSA-2015:1643 | 2015-08-18 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise MRG 2 | realtime-kernel | Will not fix |
| Red Hat Enterprise Linux 5 | kernel | Not affected |
Mitigation
You can check whether ping socket functionality is enabled by examining the net.ipv4.ping_group_range sysctl value:
~]# sysctl net.ipv4.ping_group_range
net.ipv4.ping_group_range = 1 0
"1 0" is the default value and disables the ping socket functionality even for root user. Any other value means that the ping socket functionality might be enabled for certain users on the system.
To mitigate this vulnerability make sure that you either allow the functionality to trusted local users (groups) only or set the net.ipv4.ping_group_range sysctl to the default and disabled state:
~]# sysctl net.ipv4.ping_group_range="1 0"
Please note that this might prevent some programs relying on this functionality from functioning properly.