Re: CVE request: Linux kernel: net: oops from tcp_collapse() when using splice(2)

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 05/29/2013 01:10 PM, P J P wrote:
> Hello,
>
> Linux kernel which supports splice(2) call to move data across
> file/socket descriptors via a pipe buffers, is vulnerable to a
> kernel crash that occurs while calling splice(2) over a tcp socket
> which in turn calls tcp_read_sock().
>
> A user/program could use this flaw to cause system crash, resulting
> in DoS.
>
> Upstream fix: ------------- ->
> https://git.kernel.org/linus/baff42ab1494528907bf4d5870359e31711746ae
>
>  Thank you. -- Prasad J Pandit / Red Hat Security Response Team 
> DB7A 84C5 D3F9 7CD1 B5EB  C939 D048 7860 3655 602B

Please use CVE-2013-2128 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRplz5AAoJEBYNRVNeJnmTO7cQAKpmU3GklEtrsq+f4ue/91yk
sEl9AxuczqhVqSwX3wW6ijIEC4fbNJEc+FXGEkPe7ZR/gm9CgRd53ko8aJHZyZxS
VWoyw8cVjBMqoN3x/XljI/zotJCmt5lsoo4kuP7fFkhK9FNHIKxlTtt2CIbnV66A
9WNt3XyzAf42+2Q5nfoLgs/8T9gjDalUU2dgCQ+5yhFCLstIB8U2KmcW7rXi+2U4
3z+TQY80sGbRHJPmJIuT058vNGBzoriwPjtbzmYPJ717fCQBUGoAVtBqVD469QZN
vv86FZjTKwHMnOZHJNPNH0HzVNxvYoEp9Zg/NS/FuukhGnUovDMt5ruKbu6qdpWu
mAN5fx1E1qo/JVROdX6Qb8srjvMRWB4MvGJSd2uQKShDRGsApLkUeiGigSBeoFLB
x+lEI2lbMWdFwilKdqleTZ4FBgxpsmq/wXluN3YPYrir+BmMegv6t6TeHJkLAUGo
NNE4aaIEIOdu8NGU+Tpi821va4E99wAm0CmoA6C1pNkhsWhcre61KZARvzS4tUKU
xaV/yXcw9aWryu11FUlMEW/DNTmyg/kXJRdLLRCfBNU6KfG9sObi/f2gf/q0cyLR
1Uq9ATnCa79mWeI0VxW5cQlUgWGrlFgDo55RH8qggQTTKzhjGmQSK1Njiu9z1pUR
4RslEORFbUi2183cIiE5
=42Vh
-----END PGP SIGNATURE-----